Abnormal power consumption behavior identification method, device and equipment based on load curve analysis

Abstract

The invention discloses an abnormal power consumption behavior recognition method, device and equipment based on load curve analysis, relates to the technical field of power consumer power consumption behavior analysis, and aims to comprehensively describe a consumer power consumption behavior mode, more accurately capture abnormal clues and reduce the possibility of missed judgment and misjudgment by calculating multi-dimensional features based on a load curve. Then, an isolated forest algorithm is utilized to calculate the multi-dimensional feature data set, an abnormal user preliminary screening list can be rapidly screened out from a large number of users, the abnormity checking range is efficiently narrowed, sample expansion is conducted on the abnormal user preliminary screening list through a KNN algorithm, the problem of scarcity of abnormal samples in the electric power scene is solved, and the accuracy of abnormity checking is improved. And a more balanced data basis is provided for subsequent model training. Normal samples and expanded abnormal samples are adopted to perform multi-model integrated training, different models complement advantages to cover more abnormal modes, the robustness and accuracy of abnormal recognition are enhanced, the misjudgment risk of a single model is reduced, the abnormal recognition precision is guaranteed, and the requirement of power business for precision is met.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power user electricity behavior analysis, in particular to an abnormal electricity behavior identification method, device and equipment based on load curve analysis. BACKGROUND

[0002] With the rapid development of smart grid and the popularity of power data acquisition technology, the power system has accumulated a large amount of user load curve data, which provides a data basis for intelligent identification of abnormal electricity behavior.

[0003] In related technologies, traditional detection methods mainly rely on single-dimensional indicators (such as power or voltage) or artificial experience rules to screen abnormal users, such as based on static threshold or fixed parameter model (such as Z-score, SVM), based on clustering algorithm (such as DBSCAN), based on single classification model (such as one-class SVM). However, the applicant realizes that the traditional method is difficult to effectively capture the dynamic characteristics of the load curve, resulting in a high misjudgment rate, and the high dimension of the data will limit the real-time detection ability, and the existing detection technology is based on static threshold or fixed parameter model, which lacks the adaptability to the dynamic evolution of user electricity behavior, and the data imbalance problem will lead to high model missing rate. SUMMARY

[0004] Therefore, the present application provides an abnormal electricity behavior identification method, device and equipment based on load curve analysis, mainly aiming at solving the problems that the traditional method is difficult to effectively capture the dynamic characteristics of the load curve, the misjudgment rate is high, and the static threshold or fixed parameter model lacks the adaptability to the dynamic evolution of user electricity behavior, and the missing rate is high.

[0005] According to the first aspect of the present application, an abnormal electricity behavior identification method based on load curve analysis is provided, which comprises:

[0006] Obtaining a load curve data set, calculating a multi-dimensional feature data set of each user using the load curve data set;

[0007] Using the isolated forest algorithm to calculate the multi-dimensional feature data set of a plurality of users to obtain an abnormal user preliminary screening list, and using the KNN algorithm to sample expand the abnormal user preliminary screening list to obtain an abnormal sample data set;

[0008] Obtaining a normal sample data set, using the normal sample data set and the abnormal sample data set for multi-model integrated training to obtain a plurality of abnormal identification models;

[0009] Obtain load curve data of the user to be tested, use the load curve data of the user to be tested to calculate a multidimensional feature data set of the user to be tested, input the multidimensional feature data set of the user to be tested into the multiple anomaly recognition models in sequence, and determine the target anomaly recognition result of the user to be tested by a voting method.

[0010] According to a second aspect of the present application, a device for identifying abnormal power consumption behavior based on load curve analysis is provided, the device comprising:

[0011] A calculation module, configured to obtain a load curve data set and calculate a multidimensional feature data set for each user using the load curve data set;

[0012] An expansion module is used to calculate the multidimensional feature data set of multiple users using the isolation forest algorithm to obtain a preliminary screening list of abnormal users, and to perform sample expansion on the preliminary screening list of abnormal users based on the KNN algorithm to obtain an abnormal sample data set;

[0013] A training module is used to obtain a normal sample data set, and perform multi-model integration training using the normal sample data set and the abnormal sample data set to obtain multiple abnormality recognition models;

[0014] The identification module is used to obtain the load curve data of the user to be tested, calculate the multidimensional feature data set of the user to be tested using the load curve data of the user to be tested, input the multidimensional feature data set of the user to be tested into the multiple anomaly recognition models in sequence, and determine the target anomaly recognition result of the user to be tested by voting.

[0015] According to a third aspect of the present application, a device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0016] By means of the above technical solution, the technical solution provided by the embodiment of the present application has at least the following advantages:

[0017] The application provides an abnormal electricity use behavior identification method, device and equipment based on load curve analysis. The application obtains a load curve data set, calculates a multi-dimensional feature data set of each user by using the load curve data set, and calculates the multi-dimensional features based on the load curve. The multi-dimensional features can comprehensively depict the user electricity use behavior mode. Compared with a single feature, the abnormal clues can be more accurately captured, and the possibility of missed judgment and misjudgment can be reduced. Then, the isolated forest algorithm is used to calculate the multi-dimensional feature data set of multiple users to obtain an abnormal user preliminary screening list. The KNN algorithm is used to sample expand the abnormal user preliminary screening list to obtain an abnormal sample data set. The isolated forest algorithm is used to calculate the multi-dimensional feature data set, which can quickly screen out the abnormal user preliminary screening list from a large number of users. With the unsupervised and high-dimensional data adaptability, the abnormal investigation range can be efficiently reduced. The KNN algorithm is used to sample expand the abnormal user preliminary screening list, which solves the problem of rare abnormal samples in the power scene, provides a more balanced data basis for subsequent model training, and improves the model training effect. Then, the normal sample data set is obtained, and the normal sample data set and the abnormal sample data set are used for multi-model integrated training to obtain multiple abnormal identification models. The normal sample and the expanded abnormal sample are used for multi-model integrated training. The different models complement each other to cover more abnormal modes, enhance the robustness and accuracy of abnormal identification, reduce the misjudgment risk of a single model, guarantee the abnormal identification accuracy, and meet the demand for accuracy of the power business. Finally, the load curve data of the to-be-tested user is obtained, the multi-dimensional feature data set of the to-be-tested user is calculated by using the load curve data of the to-be-tested user, the multi-dimensional feature data set of the to-be-tested user is sequentially input into multiple abnormal identification models, and the target abnormal identification result of the to-be-tested user is determined by using the voting method. The application uses the multi-dimensional features to comprehensively depict the behavior, sample expansion to solve the data imbalance, multi-model fusion to improve the precision, and voting integration to guarantee the complete link of the results, solves the problems of single feature, rare sample and insufficient model robustness in power abnormal identification, realizes high-precision and high-adaptability abnormal user identification, and provides reliable technical support for power business operation and risk control.

[0018] The above description is only a summary of the technical scheme of the application. In order to more clearly understand the technical means of the application, the application can be implemented according to the content of the specification, and in order to make the above and other purposes, characteristics and advantages of the application more obvious and easy to understand, the following specific embodiments of the application are described. BRIEF DESCRIPTION OF DRAWINGS

[0019] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for purposes of illustration only and are not considered a limitation of the application. Moreover, in the attached drawings, like reference numerals indicate the same or similar components. In the drawings:

[0020] Figure 1A method flow diagram of abnormal electricity consumption behavior identification based on load curve analysis provided by an embodiment of the application is shown.

[0021] Figure 2A A method flow diagram of abnormal electricity consumption behavior identification based on load curve analysis provided by another embodiment of the application is shown.

[0022] Figure 2B An architecture diagram of abnormal electricity consumption behavior identification based on load curve analysis provided by an embodiment of the application is shown.

[0023] Figure 3 A structure diagram of abnormal electricity consumption behavior identification based on load curve analysis provided by an embodiment of the application is shown.

[0024] Figure 4 An apparatus structure diagram of a device provided by an embodiment of the application is shown. DETAILED DESCRIPTION

[0025] In the description of the present application, it should be understood that the terms "first", "second" are used only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0026] Exemplary embodiments of the present application will be described in greater detail below with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present application can be more thoroughly understood and the scope of the present application can be accurately conveyed to those skilled in the art.

[0027] Current power data presents multi-source heterogeneous characteristics, covering time series load, device status, environmental variables and other multi-dimensional information. Traditional methods rely on a single dimension (such as power or voltage) or manual experience to screen abnormal users, and it is difficult to capture the dynamic characteristics of the load curve (such as peak-valley fluctuation and periodic regularity), resulting in a high misjudgment rate of 20%-30%. For example, the production cycle fluctuation of industrial users may cause the load curve to mutate, and the traditional algorithm cannot effectively distinguish between normal adjustment and malicious electricity stealing. In addition, the high dimension of data brings the problem of computational complexity (such as traditional DBSCAN clustering requiring manual parameter tuning), which limits the real-time detection capability and is difficult to meet the processing demand of tens of thousands of stream data per second. Moreover, existing detection techniques are mostly based on static thresholds or fixed parameter models, lacking the ability to adapt to the dynamic evolution of user electricity consumption behavior. For example, electricity thieves can evade detection by tampering with the meter parameters or forging the load curve, while static models based on Z-score or SVM cannot capture such hidden behaviors, and the data imbalance problem (abnormal users account for less than 1%) leads to model bias towards the majority class, resulting in high missed detection rate.

[0028] To solve this problem, the present application proposes an abnormal electricity consumption behavior identification method based on load curve analysis, which combines load curve to construct behavior identification features, and uses KNN classification algorithm for sample expansion of abnormal features to enhance data balance and prevent recognition errors caused by data imbalance. At the same time, active sampling is used with feature data to avoid the uncertainty of recognition caused by random sampling of the model. Then, multiple rounds of model construction are performed to prevent recognition errors caused by a single recognition model. Finally, based on different models trained by active sampling, users with unknown behaviors in the future are identified, and the result of voting by the last model is taken as the final recognition result to prevent random phenomena caused by a single model recognition. The execution subject of the present application can be an anomaly recognition system, which relies on the computing power of the server to provide services for users. The server can be a standalone server, or it can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms, etc. Basic cloud computing servers, in order to be applicable to the scenes of electricity stealing behavior detection, equipment fault early warning and energy efficiency anomaly analysis of residents, industrial and commercial users.

[0029] The embodiment of the present application provides an abnormal electricity consumption behavior identification method based on load curve analysis, as shown in Figure 1 The method comprises the following steps.

[0030] 101, obtain a load curve data set, and calculate a multi-dimensional feature data set of each user using the load curve data set.

[0031] In the embodiments of the present application, the load curve records the continuous change of the user power consumption over time (such as the hourly or minute-by-minute power consumption), which is the original holographic record of the power consumption behavior. Based on the load curve, the multi-dimensional features are calculated, which can avoid the one-sidedness of manual feature selection, and enable the subsequent anomaly identification model to directly contact the most real and fine-grained power consumption data, thereby ensuring the identification accuracy from the source. The user power consumption behavior in the power system is dynamically changed by factors such as seasons, production cycles, and equipment start-stop, and therefore the continuous time sequence characteristics of the load curve can enable the multi-dimensional features to reflect these dynamic changes in real time.

[0032] 102. The multi-dimensional feature data set of a plurality of users is calculated by using the Isolation Forest algorithm to obtain an abnormal user preliminary screening list, and the abnormal user preliminary screening list is expanded based on the KNN algorithm to obtain an abnormal sample data set.

[0033] In the embodiments of the present application, the multi-dimensional features of the power users (such as daily load rate and peak-valley difference) have high dimensions and complex distribution, the Isolation Forest does not require labeled data, and by constructing multiple random binary trees, the length of the isolated path of the sample is calculated to quickly distinguish abnormal points. Compared with the traditional clustering (such as K-Means), the number of clusters does not need to be preset, and the abnormal users deviating from the group can be automatically identified, which is suitable for the high-dimensional and unsupervised scenario of power data.

[0034] In the power scenario, the proportion of abnormal users is extremely low, and directly training the model with a small number of abnormal samples may easily lead to overfitting, therefore the KNN generates new abnormal samples through neighbor interpolation, artificially increases the number of abnormal samples, and enables the subsequent multi-model training to have a more balanced sample distribution, thereby improving the learning ability of the model for abnormal patterns.

[0035] The power anomaly identification needs to consider both “efficiency (quick positioning)” and “precision (few false positives and false negatives)”, the Isolation Forest can quickly “catch” potential abnormal users, and the KNN can “complete” the abnormal samples in a targeted manner, and the cooperation of the two can make the technical solution fit the actual pain points of the power business (such as a large number of users, few abnormal samples, and the need for accurate identification), thereby providing effective support for anti-electricity stealing, equipment fault warning and other scenarios.

[0036] 103. A normal sample data set is obtained, and the normal sample data set and the abnormal sample data set are used for multi-model integrated training to obtain a plurality of anomaly identification models.

[0037] In the embodiments of the present application, the normal user samples in the power scenario are extremely numerous, and the abnormal samples are extremely few, and by constructing a training set by using the normal samples and the expanded abnormal samples, the model can be prevented from ignoring the abnormal patterns due to the dominance of the normal samples. Moreover, the multi-model parallel training can cover more abnormal patterns, thereby avoiding the false negatives caused by the limited perspective of a single model.

[0038] 104、Obtain the load curve data of the to-be-tested user, calculate the multi-dimensional feature data set of the to-be-tested user by using the load curve data of the to-be-tested user, input the multi-dimensional feature data set of the to-be-tested user into the multiple anomaly recognition models in sequence, and determine the target anomaly recognition result of the to-be-tested user by using a voting method.

[0039] In the embodiment of the present application, the feature calculation of the to-be-tested user, that is, the process of calculating the multi-dimensional feature based on the load curve and calculating the multi-dimensional feature data set of each user by using the load curve data set, is completely consistent, ensuring the uniformity of model input. The to-be-tested feature is input into multiple models, and each model can judge whether it is abnormal from different angles. Since the power anomaly scene is complex (such as electricity stealing, equipment failure, malicious arrears, etc.), the multi-model integration can cover different abnormal feature patterns and reduce the probability of misjudgment of a single model.

[0040] Compared with the prior art, the embodiment of the present application obtains the load curve data set, calculates the multi-dimensional feature data set of each user by using the load curve data set, and can fully depict the user power consumption behavior pattern based on the load curve calculation multi-dimensional feature. Compared with a single feature, it can more accurately capture abnormal clues and reduce the possibility of missed judgment and misjudgment. Then, the isolated forest algorithm is used to calculate the multi-dimensional feature data set of multiple users to obtain an abnormal user preliminary screening list, and the KNN algorithm is used to sample expand the abnormal user preliminary screening list to obtain an abnormal sample data set. The isolated forest algorithm is used to calculate the multi-dimensional feature data set, which can quickly screen out an abnormal user preliminary screening list from a large number of users, efficiently narrow down the abnormal investigation range with the aid of its unsupervised and high-dimensional data adaptability, sample expand the abnormal user preliminary screening list by using the KNN algorithm, solve the problem of scarcity of abnormal samples in the power scene, provide a more balanced data basis for subsequent model training, and improve the model training effect. Subsequently, a normal sample data set is obtained, and the normal sample data set and the abnormal sample data set are used for multi-model integrated training to obtain multiple anomaly recognition models. The normal sample and the expanded abnormal sample are used for multi-model integrated training, the advantages of different models are complementary, more abnormal patterns can be covered, the robustness and accuracy of anomaly recognition are enhanced, the risk of misjudgment of a single model is reduced, the accuracy of anomaly recognition is ensured, and the demand of the power business for accuracy is met. Finally, the load curve data of the to-be-tested user is obtained, the multi-dimensional feature data set of the to-be-tested user is calculated by using the load curve data of the to-be-tested user, the multi-dimensional feature data set of the to-be-tested user is input into multiple anomaly recognition models in sequence, and the target anomaly recognition result of the to-be-tested user is determined by using a voting method. The present application uses multi-dimensional features to fully depict behaviors, sample expansion to solve data imbalance, multi-model fusion to improve accuracy, and voting integration to ensure the complete link of the results, solves the pain points of single feature, sample scarcity, and insufficient model robustness in power anomaly recognition, realizes high-precision and high-adaptability anomaly user recognition, and provides reliable technical support for power business operation and risk control.

[0041] Further, as a refinement and extension of the above embodiment, in order to fully describe the specific implementation process of the embodiment, the embodiment of the application provides another abnormal electricity consumption behavior identification method based on load curve analysis, as shown in the figure, the method comprises: Figure 2A

[0042] 201, obtain a load curve data set, and calculate a multi-dimensional feature data set of each user by using the load curve data set.

[0043] In the embodiment of the application, for each user, the load curve data of the user is extracted from the load curve data set, the load curve data is divided according to natural days, the continuous load curve is split into N single-day load curves, at least one single-day load curve data is obtained, and each single-day curve contains the load data of the user on a certain day.

[0044] For each single-day load curve data of the user, the daily load average and the daily load maximum are obtained from the single-day load curve data, the daily load average and the daily load maximum are used for calculation, the daily load rate corresponding to the single-day load curve data is obtained, and the calculation formula is formula 1 as follows:

[0045] Formula 1:

[0046] Wherein, DLR is the daily load rate, reflecting the load balance degree of the user throughout the day, is the daily load average, and max(P t ) is the daily load maximum.

[0047] The daily load minimum is obtained from the single-day load curve data, the daily load minimum and the daily load maximum are used for calculation, the peak-valley difference corresponding to the single-day load curve data is obtained, and the calculation formula is formula 2 as follows:

[0048] Formula 2: PVD = max(P t )-min(P t ),

[0049] Wherein, PVD is the peak-valley difference, reflecting the load fluctuation degree, min(P t ) is the daily load minimum, and max(P t ) is the daily load maximum.

[0050] A plurality of time point loads are obtained from the single-day load curve data, the plurality of time point loads and the daily load maximum are used for calculation, the night load ratio corresponding to the single-day load curve data is obtained, and the calculation formula is formula 3 as follows:

[0051] Formula 3: ​

[0052] wherein, NLR is night load ratio, detecting abnormal night electricity behavior, P t is point load, max(P t ) is daily load maximum.

[0053] Peak period average load is obtained in single day load curve data, peak period average load and daily load maximum are used for calculation, to obtain single day load curve data corresponding peak period load rate, calculation formula is following formula 4:

[0054] Formula 4:

[0055] Wherein, rate peak is peak period load rate, reflecting peak period load change, P mean_peak is peak period average load, max(P t ) is daily load maximum.

[0056] Peak flat period average load is obtained in single day load curve data, peak flat period average load and daily load maximum are used for calculation, to obtain single day load curve data corresponding flat period load rate, calculation formula is following formula 5:

[0057] Formula 5:

[0058] Wherein, rate sh is flat period load rate, reflecting flat period load change, P mean_sh is peak flat period average load, max(P t ) is daily load maximum.

[0059] Peak valley period average load is obtained in single day load curve data, peak valley period average load and daily load maximum are used for calculation, to obtain single day load curve data corresponding valley period load rate, calculation formula is following formula 6:

[0060] Formula 6:

[0061] Wherein, rate val is valley period load rate, reflecting valley period load change, P mean_val is peak valley period average load, max(P t ) is daily load maximum.

[0062] Three-phase voltage of multiple sampling time points is obtained in single day load curve data, three-phase voltage of multiple sampling time points is used for calculation, to obtain voltage three-item unbalance rate of each sampling time point, calculation formula is following formula 7:

[0063] Formula 7:

[0064] wherein, PVU is the voltage three-item imbalance rate, max[V A B C ] is the maximum value in the three-phase voltage, min[V A B C ] is the minimum value in the three-phase voltage, average[V A B C ] is the average value of the three-phase voltage.

[0065] The three-phase currents at multiple sampling time points are obtained in the single-day load curve data, the three-phase currents at multiple sampling time points are used for calculation, the current three-item imbalance rate at each sampling time point is obtained, and the calculation formula is formula 8 as follows:

[0066] Formula 8:

[0067] wherein, PIU is the current three-item imbalance rate, max[I A B C ] is the maximum value in the three-phase current, min[I A B C ] is the minimum value in the three-phase current, average[I A B C ] is the average value of the three-phase current.

[0068] Based on the above process, the daily load rate, the peak-valley difference, the night load ratio, the peak period load rate, the flat period load rate, the valley period load rate, the voltage three-item imbalance rate at multiple sampling time points, and the current three-item imbalance rate at multiple sampling time points are used as the multi-dimensional feature vector corresponding to the single-day load curve data.

[0069] Then, at least one single-day load curve data is processed respectively to obtain the multi-dimensional feature vector corresponding to the at least one single-day load curve data, and the multi-dimensional feature vector corresponding to the at least one single-day load curve data is used as the multi-dimensional feature data set of the user. Through the daily load rate (reflecting the all-day load balance degree of the user), the peak-valley difference (measuring the load fluctuation degree), the night load ratio (detecting abnormal night electricity use behavior), the voltage / current three-phase imbalance rate (reflecting the balance of the three-phase voltage / current), and the like, the electricity use time distribution law and the electrical operation characteristics are fully described from two dimensions. Compared with the analysis method relying only on a single feature (such as total electricity consumption), the embodiments of the present application can capture more hidden abnormal patterns.

[0070] ​​​​​​​​​​​​202、divide the multi-dimensional feature data set of the plurality of users into a plurality of user date samples, perform a plurality of random feature selection division operations on the plurality of user date samples based on the plurality of features, and obtain a plurality of forests.

[0071] In the embodiment of the present application, the isolated forest algorithm is used for initial screening of historical abnormal behaviors, and a random binary tree (i.e., random division of data space) is constructed to separate normal samples and abnormal samples. First, the multi-dimensional feature data set of the plurality of users is divided into a plurality of user date samples, wherein each user date sample is a multi-dimensional feature vector, and the user date sample covers various power load and electrical imbalance features such as daily load rate and peak-valley difference, so as to fully utilize multi-dimensional data, mine the effect of different features on user sample division, and improve the ability to capture the inherent law of data. Then, a plurality of features are obtained, wherein the features are any one of daily load rate, peak-valley difference, night load ratio, peak period load rate, flat period load rate, valley period load rate, voltage three-item imbalance rate, and current three-item imbalance rate.

[0072] Based on the plurality of features, a plurality of random feature selection division operations are performed on the plurality of user date samples to obtain a plurality of forests, wherein each forest includes a plurality of binary trees, and the root nodes of the plurality of binary trees have the same split feature.

[0073] Specifically, any one feature in the plurality of features is selected as a root node split feature, first feature data corresponding to the root node split feature is extracted from the plurality of user date samples, a root node split point is determined according to the first feature data, a random feature selection division operation is performed on the plurality of user date samples by using the root node split point, and a first subset and a second subset are obtained.

[0074] Then, any one feature in the plurality of features is selected as a second split feature, second feature data corresponding to the second split feature is extracted from the first subset, a second split point is determined according to the second feature data, a random feature selection division operation is performed on the first subset by using the second split point, and a third subset and a fourth subset are obtained.

[0075] Subsequently, any one feature in the plurality of features is selected as a third split feature, third feature data corresponding to the third split feature is extracted from the second subset, a third split point is determined according to the third feature data, a random feature selection division operation is performed on the second subset by using the third split point, and a fifth subset and a sixth subset are obtained.

[0076] Then the random feature selection and division operation is repeatedly performed until it is determined that there is only one sample in the divided subset or the preset depth is reached, the random feature selection and division operation is stopped, a binary tree is obtained, and the process of constructing a binary tree based on the random feature selection and division operation is repeated to obtain a forest. From the root node, the split feature is selected, the split point is determined, the sample subset is dynamically divided, the complex data distribution is adapted, the user date samples are accurately classified, until the sample quantity or depth requirement is met, and a binary tree that fits the data characteristics is constructed.

[0077] For example, the DLR feature is selected as the root node, the split point of the feature is determined, for example, DLR = 60%, the sample is divided into "DLR ≤ 60% subset" and "DLR > 60% subset" using the split point; the operation is repeated on the subset, including selecting a new feature, determining a split point, and splitting, until there is only one sample in the subset or the preset depth is reached, to form a binary tree; the process of constructing a binary tree by randomly selecting features is repeated to obtain multiple trees, which form a forest, which is part of the random forest. The structure of multiple forests and multiple binary trees is obtained through ensemble learning, the results of different binary trees are complementary, the risk of overfitting of a single tree is reduced, the overall stability and reliability of the model are improved, and the random selection of features allows each tree to focus on different features and cover more abnormal patterns.

[0078] 203. Each user date sample is processed by multiple forests to obtain the target recognition result of each user date sample.

[0079] In the embodiments of the present application, for each user date sample, the path length corresponding to each binary tree in each forest is calculated to obtain multiple path lengths corresponding to each forest, the abnormal score corresponding to each forest is calculated using the multiple path lengths corresponding to each forest, the recognition result of each forest to the user date sample is determined based on the score threshold and the abnormal score corresponding to each forest, and the intersection operation is performed on the recognition results of the user date sample based on multiple forests to obtain the target recognition result of the user date sample. In this way, each user date sample is processed by multiple forests to obtain the target recognition result of each user date sample. By calculating the path length of the binary tree in each forest and the abnormal score, and combining the score threshold to identify the multi-dimensional evaluation sample, the abnormality can be accurately captured more accurately than a single identification method, and the target recognition accuracy is improved. Moreover, the intersection operation is performed based on the recognition results of multiple forests, and the multiple results are cross-validated, which can filter the errors and accidental factors of single forest recognition, so that the final target recognition result is more reliable.

[0080] 204. Multiple user date samples indicated as abnormal by the target recognition result are selected from the multiple user date samples as an abnormal user preliminary screening list.

[0081] In the embodiments of the present application, from the plurality of user date samples, those user date samples identified as abnormal (i.e., the target identification result indicates abnormality) are screened out, and these samples are aggregated to form an abnormal user preliminary screening list for subsequent further processing (such as sample expansion, accurate identification, etc.).

[0082] 205. Based on the KNN algorithm, the sample expansion is performed on the abnormal user preliminary screening list to obtain an abnormal sample data set.

[0083] In the embodiments of the present application, the abnormal user preliminary screening list is randomly sampled with replacement to obtain a plurality of sub-training sets. For example, N samples are randomly sampled with replacement to generate M sub-training sets, and M = 100. Then, the KNN expansion rule of each sub-training set is determined by using the KNN algorithm. For example, for an abnormal sample A in a certain sub-training set, K samples closest to the feature of the abnormal sample A are found, and new samples A' are generated by interpolation / copying, etc. Then, the sample expansion is performed on each sub-training set by using the KNN expansion rule of each sub-training set, and the plurality of sub-training sets after sample expansion are used as the abnormal sample data set. In the power scenario, the proportion of abnormal samples is extremely low, and directly training the model with a small number of abnormal samples can easily lead to overfitting of the model. By KNN expansion, the number of abnormal samples can be increased to solve the data imbalance problem. Moreover, KNN expands the sample based on the feature similarity, and the newly generated sample is close to the original abnormal sample in the feature space. Compared with randomly generated samples, KNN expansion can accurately preserve the abnormal feature details and ensure the quality of subsequent model training.

[0084] 206. Obtain a normal sample data set, and perform multi-model integrated training by using the normal sample data set and the abnormal sample data set to obtain a plurality of abnormal identification models.

[0085] In the embodiments of the present application, a preset number is obtained, and the normal sample data set and the abnormal sample data set are divided into a preset number of sample sets, wherein the proportion of normal samples and abnormal samples in the sample set is consistent, which can solve the problem of data imbalance and make the model training more stable. Then a preset number of training algorithms are obtained, and the preset number of training algorithms are used to perform model training on the preset number of sample sets respectively to obtain a plurality of abnormality identification models, wherein the training algorithms can be XGBOOST, catboost, BP neural network, SVM, etc. For example, based on the abnormal sample set, normal samples are sampled in the same proportion to form four sample sets, and then four electricity behavior abnormality identification models are constructed using XGBOOST algorithm, catboost algorithm, BP neural network, and SVM algorithm to accurately identify possible future abnormal behaviors. Different algorithms have different ways of capturing and learning data features, such as tree models (XGBOOST and catboost) that are good at processing nonlinear relationships and mining feature importance; BP neural network is suitable for fitting complex patterns; SVM has an advantage in small sample and high-dimensional data, etc. Multi-algorithm training can combine the strengths of each algorithm, improve the recognition coverage and accuracy of the model for different abnormal patterns, reduce the risk of overfitting of a single model, and make the abnormality identification model more general and reliable when facing future diverse and complex actual scenarios.

[0086] The multiple models constructed based on multiple sample sets and multiple algorithms can accurately capture features and identify abnormalities for different types of abnormal behaviors (such as load abnormality and electricity usage pattern abnormality) in power user scenarios, helping to provide early warning and timely intervention to ensure the stable operation of power systems.

[0087] 207、Obtain the load curve data of the to-be-tested user, calculate the multi-dimensional feature data set of the to-be-tested user using the load curve data of the to-be-tested user, input the multi-dimensional feature data set of the to-be-tested user into the multiple abnormality identification models in sequence, and determine the target abnormality identification result of the to-be-tested user through voting.

[0088] In the embodiments of the present application, the multi-dimensional feature data set of the to-be-tested user is input into the multiple abnormality identification models in sequence, the abnormality identification results output by each abnormality identification model are obtained, and the voting method is used to count a first number of abnormality identification results indicating that the to-be-tested user is a normal user and a second number of abnormality identification results indicating that the to-be-tested user is an abnormal user.

[0089] If the first number is greater than the second number, a target anomaly recognition result is generated indicating that the user to be tested is a normal user. If the first number is less than the second number, a target anomaly recognition result is generated indicating that the user to be tested is an abnormal user. If the first number is equal to the second number, the load curve data of the user to be tested is recalculated, the recalculated multidimensional feature data set is input into multiple anomaly recognition models in sequence, and the target anomaly recognition result of the user to be tested is re-determined by voting. Multiple models predict and vote to summarize the results separately, which can offset the deviation / error of a single model. For example, model A may make a wrong judgment, while models B and C make a correct judgment. Voting can correct it, thereby improving the accuracy and stability of anomaly recognition and reducing missed judgments / misjudgments.

[0090] Because different anomaly detection models (such as XGBoost and SVM) interpret data from different perspectives, XGBoost excels at capturing nonlinear feature correlations, while SVM is more sensitive to edge cases. Through multi-model voting, misjudgments by a single model (such as an SVM misclassifying a normal sample as an anomaly) are offset by correct judgments from other models, reducing the overall misjudgment rate.

[0091] Based on the above process, the schematic diagram of the architecture of an abnormal power consumption behavior identification based on load curve analysis proposed in the embodiment of the present application is as follows:

[0092] like Figure 2B As shown, electricity usage feature construction involves first sorting and extracting key features from user electricity usage data (such as daily load factor, peak-to-valley difference, and three-phase imbalance). These features serve as the basis for determining whether electricity usage behavior is abnormal. The isolation forest model combined with historical user behavior anomaly identification uses the isolation forest model to analyze historical electricity usage data and identify user groups with abnormal historical behavior. This is equivalent to identifying known abnormal samples, paving the way for subsequent expansion and modeling. Abnormal sample expansion uses the KNN algorithm to expand the sample group of users with abnormal historical electricity usage behavior to obtain an expanded abnormal group. Because abnormal samples are often rare in real-world scenarios, KNN can identify similar samples and generate new abnormal samples, increasing the number and enriching the number of abnormal samples, facilitating subsequent model training. Active sampling combines the expanded abnormal group with users with normal electricity usage behavior and divides them into four groups (i.e., the abnormal group + normal groups 1-4), maintaining a consistent ratio of normal to abnormal samples within each group. The multi-model construction involves training four sets of samples using different algorithms: XGBoost, CatBoost, BP Neural Network, and Support Vector Machine (SVM). This results in four anomaly recognition models. For each user, their electricity usage characteristics are extracted and fed into the four models. Each model outputs an abnormal / normal result. The results from the four models are tallied, and a voting method is used to determine whether an anomaly is detected. For example, if three models indicate an abnormality and one indicates normality, the result is considered abnormal and the final recognition result is output.

[0093] The embodiment of the application provides a method for identifying abnormal power consumption behavior based on load curve analysis, compared with the prior art, the embodiment of the application obtains a load curve data set, calculates a multi-dimensional feature data set of each user by using the load curve data set, and can comprehensively depict the user power consumption behavior mode based on the load curve calculation multi-dimensional feature, compared with a single feature, can more accurately capture abnormal clues, and reduces the possibility of missed judgment and misjudgment. Then, the isolated forest algorithm is used to calculate the multi-dimensional feature data set of a plurality of users, an abnormal user preliminary screening list is obtained, and the KNN algorithm is used for sample expansion on the abnormal user preliminary screening list, to obtain an abnormal sample data set, the isolated forest algorithm is used for multi-dimensional feature data set calculation, which can quickly screen out an abnormal user preliminary screening list from a large number of users, and with the unsupervised and high-dimensional data adaptability, the abnormal investigation range is efficiently reduced, the KNN algorithm is used for sample expansion on the abnormal user preliminary screening list, the problem of abnormal sample scarcity in the power scene is solved, a more balanced data basis is provided for subsequent model training, and the model training effect is improved. Then, a normal sample data set is obtained, the normal sample data set and the abnormal sample data set are used for multi-model integrated training, a plurality of abnormal identification models are obtained, the normal sample and the expanded abnormal sample are used for multi-model integrated training, different models complement each other to cover more abnormal modes, enhance the robustness and accuracy of abnormal identification, reduce the misjudgment risk of a single model, guarantee the abnormal identification precision, and meet the accuracy requirement of the power business. Finally, the load curve data of the to-be-tested user is obtained, the load curve data of the to-be-tested user is used to calculate the multi-dimensional feature data set of the to-be-tested user, the multi-dimensional feature data set of the to-be-tested user is sequentially input into the plurality of abnormal identification models, and the target abnormal identification result of the to-be-tested user is determined by using the voting method. The application uses a complete link of multi-dimensional features, sample expansion, multi-model fusion, precision improvement, and voting integration to guarantee the result, solves the problems of single feature, sample scarcity, and insufficient model robustness in power abnormal identification, realizes high-precision and high-adaptability abnormal user identification, and provides reliable technical support for power business operation and risk control.

[0094] Further, as Figure 1 a specific implementation of the method, the embodiment of the application provides an abnormal power consumption behavior identification device based on load curve analysis, as shown in Figure 3 The device comprises a calculation module 301, an expansion module 302, a training module 303 and an identification module 304.

[0095] The calculation module 301 is used for obtaining a load curve data set, and calculating a multi-dimensional feature data set of each user by using the load curve data set.

[0096] The expansion module 302 is configured to calculate a plurality of user multi-dimensional feature data sets by using an isolation forest algorithm to obtain an abnormal user preliminary screening list, and perform sample expansion on the abnormal user preliminary screening list based on a KNN algorithm to obtain an abnormal sample data set;

[0097] The training module 303 is configured to obtain a normal sample data set, perform multi-model integrated training on the normal sample data set and the abnormal sample data set to obtain a plurality of abnormal recognition models;

[0098] The recognition module 304 is configured to obtain load curve data of a to-be-tested user, calculate a multi-dimensional feature data set of the to-be-tested user by using the load curve data of the to-be-tested user, input the multi-dimensional feature data set of the to-be-tested user into the plurality of abnormal recognition models in sequence, and determine a target abnormal recognition result of the to-be-tested user by using a voting method.

[0099] In a specific application scenario, the calculation module 301 is configured to, for each user, extract load curve data of the user from the load curve data set, divide the load curve data according to natural days to obtain at least one single-day load curve data, for each single-day load curve data of the user, obtain a daily load average value and a daily load maximum value in the single-day load curve data, and calculate the daily load average value and the daily load maximum value to obtain a daily load rate corresponding to the single-day load curve data,

[0100]

[0101] wherein, DLR is the daily load rate, is the daily load average value, and max(P t ) is the daily load maximum value; a daily load minimum value is obtained in the single-day load curve data, and the daily load minimum value and the daily load maximum value are calculated to obtain a peak-valley difference corresponding to the single-day load curve data,

[0102] PVD=max(P t )-min(P t ),

[0103] wherein, PVD is the peak-valley difference, min(P t ) is the daily load minimum value, and max(P t ) is the daily load maximum value; a plurality of time point loads are obtained in the single-day load curve data, and the plurality of time point loads and the daily load maximum value are calculated to obtain a night load ratio corresponding to the single-day load curve data,

[0104]

[0105] Wherein, NLP is the night load ratio, P t is the load at the time point, max(P t ) is the maximum load value of the day; obtain the peak average load from the single-day load curve data, use the peak average load and the maximum load value of the day to calculate, and obtain the peak load rate corresponding to the single-day load curve data,

[0106]

[0107] Among them, rate peak is the peak load rate, P mean_peak is the average load during the peak period, max(P t ) is the maximum load value of the day; obtain the peak-average load in the single-day load curve data, use the peak-average load and the maximum load value of the day to calculate, and obtain the average load rate corresponding to the single-day load curve data.

[0108]

[0109] Among them, rate sh is the average load rate, P mean_sh is the average load during the peak and flat periods, max(P t ) is the maximum load value of the day; obtain the average load during the peak and valley periods from the single-day load curve data, and calculate using the average load during the peak and valley periods and the maximum load value of the day to obtain the valley load rate corresponding to the single-day load curve data,

[0110]

[0111] Among them, rate val is the valley load rate, P mean_val is the average load during the peak and valley periods, max(P t ) is the maximum load value of the day; obtaining the three-phase voltages at multiple sampling time points in the single-day load curve data, and using the three-phase voltages at the multiple sampling time points for calculation to obtain the voltage three-term imbalance rate at each sampling time point,

[0112]

[0113] Among them, PVU is the three-term unbalance rate of voltage, max[V A ,V B ,V C ] is the maximum value of the three-phase voltage, min[V A ,V B ,V C] is the minimum value of the three-phase voltage, average [V A ,V B ,V C ] is the three-phase voltage average value; obtain the three-phase current at multiple sampling points in the single-day load curve data, and calculate using the three-phase current at the multiple sampling points to obtain the current three-term imbalance rate at each sampling point,

[0114]

[0115] Wherein, PIU is the three-term imbalance rate of the current, max[I A ,I B ,I C ] is the maximum value of the three-phase current, min[I A ,I B ,I C ] is the minimum value among the three-phase currents, average[I A ,I B ,I C ] is the average value of the three-phase current; the daily load rate, the peak-to-valley difference, the nighttime load ratio, the peak load rate, the flat load rate, the valley load rate, the voltage three-item imbalance rate at the multiple sampling time points, and the current three-item imbalance rate at the multiple sampling time points are used as the multidimensional feature vector corresponding to the single-day load curve data; the at least one single-day load curve data is processed respectively to obtain the multidimensional feature vector corresponding to the at least one single-day load curve data, and the multidimensional feature vector corresponding to the at least one single-day load curve data is used as the multidimensional feature data set of the user.

[0116] In a specific application scenario, the expansion module 302 is configured to divide the multi-dimensional feature data set of the plurality of users into a plurality of user date samples, each user date sample being a multi-dimensional feature vector; obtain a plurality of features, the features being any one of daily load rate, peak-valley difference, night load ratio, peak period load rate, flat period load rate, valley period load rate, voltage three unbalance rate, and current three unbalance rate; perform a plurality of random feature selection and division operations on the plurality of user date samples based on the plurality of features to obtain a plurality of forests, each forest including a plurality of binary trees, and the root nodes of the plurality of binary trees have the same split feature; for each user date sample, calculate the path length corresponding to each binary tree in each forest to obtain a plurality of path lengths corresponding to each forest, calculate an anomaly score corresponding to each forest using the plurality of path lengths corresponding to each forest, determine the identification result of each forest on the user date sample based on the anomaly score corresponding to each forest and the score threshold, and perform an intersection operation on the identification results of the plurality of forests on the user date sample to obtain a target identification result of the user date sample; process each user date sample using the plurality of forests to obtain a target identification result of each user date sample; and select a plurality of user date samples indicated as abnormal by the target identification result from the plurality of user date samples as an abnormal user preliminary screening list.

[0117] In a specific application scenario, the expansion module 302 is configured to randomly select one feature from the plurality of features as a root node split feature, extract first feature data corresponding to the root node split feature from the plurality of user date samples, determine a root node split point based on the first feature data, perform the random feature selection and division operation on the plurality of user date samples using the root node split point to obtain a first subset and a second subset; randomly select one feature from the plurality of features as a second split feature, extract second feature data corresponding to the second split feature from the first subset, determine a second split point based on the second feature data, perform the random feature selection and division operation on the first subset using the second split point to obtain a third subset and a fourth subset; randomly select one feature from the plurality of features as a third split feature, extract third feature data corresponding to the third split feature from the second subset, determine a third split point based on the third feature data, and perform the random feature selection and division operation on the second subset using the third split point to obtain a fifth subset and a sixth subset; repeat the random feature selection and division operation until only one sample is included in the divided subset or a preset number of depths is reached, stop the random feature selection and division operation, obtain one binary tree, and repeat the process of constructing a binary tree based on the random feature selection and division operation to obtain one forest.

[0118] In a specific application scenario, the expansion module 302 is configured to randomly extract the initial screening list of abnormal users to obtain a plurality of sub-training sets; determine a KNN expansion rule for each of the sub-training sets by using the KNN algorithm, and expand samples in each of the sub-training sets by using the KNN expansion rule for each of the sub-training sets; and use the plurality of sub-training sets after sample expansion as the abnormal sample data set.

[0119] In a specific application scenario, the training module 303 is configured to obtain a preset number, divide the normal sample data set and the abnormal sample data set into the preset number of sample sets, and the proportion of normal samples to abnormal samples in each of the sample sets is consistent; obtain a preset number of training algorithms, and use the preset number of training algorithms to respectively train the preset number of sample sets to obtain the plurality of abnormal recognition models.

[0120] In a specific application scenario, the recognition module 304 is configured to input the multi-dimensional feature data set of the to-be-tested user into the plurality of abnormal recognition models in sequence, and obtain an abnormal recognition result output by each of the abnormal recognition models; use the voting method to count a first number of abnormal recognition results indicating that the to-be-tested user is a normal user and a second number of abnormal recognition results indicating that the to-be-tested user is an abnormal user in the plurality of abnormal recognition results; if the first number is greater than the second number, generate a target abnormal recognition result indicating that the to-be-tested user is a normal user; and if the first number is less than the second number, generate a target abnormal recognition result indicating that the to-be-tested user is an abnormal user.

[0121] In a specific application scenario, the recognition module 304 is configured to, if the first number is equal to the second number, recompute by using the load curve data of the to-be-tested user, input the recomputed multi-dimensional feature data set into the plurality of abnormal recognition models in sequence, and re-determine the target abnormal recognition result of the to-be-tested user by using the voting method.

[0122] Compared with the prior art, the embodiment of the application can fully depict the user power consumption behavior mode by calculating the multi-dimensional feature data set of each user based on the load curve, and can more accurately capture abnormal clues and reduce the possibility of missed or misjudged compared with single features. Then, the isolated forest algorithm is used to calculate the multi-dimensional feature data set of multiple users to obtain an abnormal user preliminary screening list, and the KNN algorithm is used to sample expand the abnormal user preliminary screening list to obtain an abnormal sample data set. The isolated forest algorithm is used to calculate the multi-dimensional feature data set, which can quickly screen out an abnormal user preliminary screening list from a large number of users, efficiently narrow down the abnormal investigation range with the aid of its unsupervised and high-dimensional data adaptability, and solve the problem of scarcity of abnormal samples in the power scene by using the KNN algorithm to sample expand the abnormal user preliminary screening list, provide a more balanced data basis for subsequent model training, and improve the model training effect. Then, the normal sample data set is obtained, and the normal sample data set and the abnormal sample data set are used for multi-model integrated training to obtain multiple abnormal identification models. The normal sample and the expanded abnormal sample are used for multi-model integrated training, the advantages of different models are complementary, more abnormal patterns can be covered, the robustness and accuracy of abnormal identification are enhanced, the risk of misjudgment of a single model is reduced, the accuracy of abnormal identification is ensured, and the demand of the power business for accuracy is met. Finally, the load curve data of the to-be-tested user is obtained, the multi-dimensional feature data set of the to-be-tested user is calculated by using the load curve data of the to-be-tested user, the multi-dimensional feature data set of the to-be-tested user is sequentially input into multiple abnormal identification models, and the target abnormal identification result of the to-be-tested user is determined by using the voting method. The application uses a complete link of multi-dimensional features to fully depict behaviors, sample expansion to solve data imbalance, multi-model fusion to improve precision, and voting integration to ensure results, solves the pain points of single features, sample scarcity, and insufficient model robustness in power abnormal identification, realizes high-precision and high-adaptability abnormal user identification, and provides reliable technical support for power business operation and risk control.

[0123] It should be noted that other corresponding descriptions of the various functional units involved in the abnormal power consumption behavior identification device based on load curve analysis provided by the embodiments of the application can be referred to Figure 1 and Figures 2A-2B for corresponding descriptions, which will not be described here.

[0124] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the application are all information and data authorized by the user or authorized by all parties.

[0125] Any technical features in the above embodiments can be combined, and for the sake of brevity, not all possible combinations are described, but it is understood that any combination of the technical features is within the scope of the present disclosure.

[0126] The above embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the patent scope of the present application. It should be noted that, for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

[0127] In the example embodiment, referring to Figure 4 A device is also provided, which includes a bus, a processor, a memory, and a communication interface, and can further include an input / output interface and a display device, wherein the communication between the various functional units can be completed through the bus. The memory stores a computer program, and the processor is configured to execute the program stored in the memory to execute the abnormal electricity consumption behavior identification method based on load curve analysis in the above embodiment.

[0128] A computer readable storage medium, which stores a computer program, the computer program is executed by a processor to implement the steps of the abnormal electricity consumption behavior identification method based on load curve analysis.

[0129] Through the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by hardware, or by means of software and necessary general hardware platform. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.), and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in various implementation scenarios of the present application.

[0130] Those skilled in the art can understand that the accompanying drawings are only a schematic diagram of a preferred implementation scenario, and the modules or processes in the drawings are not necessarily required for implementing the present application.

[0131] Those skilled in the art can understand that the modules in the device in the implementation scenario can be distributed in the device in the implementation scenario according to the description of the implementation scenario, or can be changed and located in one or more devices different from the implementation scenario. The modules in the above implementation scenario can be combined into one module, or can be further split into a plurality of sub-modules.

[0132] The above application number is only for description, and does not represent the advantages and disadvantages of the implementation scene.

[0133] The above disclosure is only a few specific implementation scenarios of the application, but the application is not limited thereto, and any changes that can be thought of by those skilled in the art should fall within the protection scope of the application.

Claims

1. A method for identifying abnormal power consumption behavior based on load curve analysis, characterized in that: include: Obtaining a load curve data set, and using the load curve data set to calculate a multidimensional feature data set for each user; An isolation forest algorithm is used to calculate the multidimensional feature data set of multiple users to obtain a preliminary screening list of abnormal users, and a KNN algorithm is used to expand the sample of the preliminary screening list of abnormal users to obtain an abnormal sample data set; Obtaining a normal sample data set, and performing multi-model integration training using the normal sample data set and the abnormal sample data set to obtain multiple abnormality recognition models; Obtain load curve data of the user to be tested, use the load curve data of the user to be tested to calculate a multidimensional feature data set of the user to be tested, input the multidimensional feature data set of the user to be tested into the multiple anomaly recognition models in sequence, and determine the target anomaly recognition result of the user to be tested by a voting method.

2. The method according to claim 1, characterized in that The step of obtaining a load curve dataset and using the load curve dataset to calculate a multidimensional feature dataset for each user includes: For each user, extract the load curve data of the user from the load curve data set, divide the load curve data according to natural days, and obtain at least one single-day load curve data; For each of the single-day load curve data of the user, the daily load average value and the daily load maximum value are obtained from the single-day load curve data, and the daily load average value and the daily load maximum value are used to perform calculations to obtain the daily load rate corresponding to the single-day load curve data. Wherein, DLR is the daily load rate, is the average load value of the day, max(P t ) is the maximum load value of the day; Obtain the minimum load value of the day from the single-day load curve data, and use the minimum load value of the day and the maximum load value of the day to perform calculations to obtain the peak-to-valley difference corresponding to the single-day load curve data. PVD=max(P t )-min(P t ), Wherein, PVD is the peak-to-valley difference, min(P t ) is the minimum load value of the day, max(P t ) is the maximum load value of the day; Obtain multiple time point loads from the single-day load curve data, and calculate using the multiple time point loads and the maximum load value of the day to obtain the nighttime load ratio corresponding to the single-day load curve data. Wherein, NLP is the night load ratio, P t is the load at the time point, max(P t ) is the maximum load value of the day; Obtain the peak average load from the single-day load curve data, and calculate using the peak average load and the maximum load value of the day to obtain the peak load rate corresponding to the single-day load curve data. Among them, rate peak is the peak load rate, P mean_peak is the average load during the peak period, max(P t ) is the maximum load value of the day; Obtain the average load during peak and flat periods from the single-day load curve data, and calculate using the average load during peak and flat periods and the maximum load value of the day to obtain the flat period load rate corresponding to the single-day load curve data. Among them, rate sh is the average load rate, P mean_sh is the average load during the peak and flat periods, max(P t ) is the maximum load value of the day; Obtain the peak-valley average load from the single-day load curve data, and calculate using the peak-valley average load and the maximum load of the day to obtain the valley load rate corresponding to the single-day load curve data. Among them, rate val is the valley load rate, P mean_val is the average load during the peak and valley periods, max(P t ) is the maximum load value of the day; The three-phase voltages at multiple sampling time points are obtained from the single-day load curve data, and the three-phase voltages at the multiple sampling time points are used for calculation to obtain the voltage three-term imbalance rate at each sampling time point. Among them, PVU is the three-term unbalance rate of voltage, max[V A ,V B ,V C ] is the maximum value of the three-phase voltage, min[V A ,V B ,V C ] is the minimum value of the three-phase voltage, average [V A ,V B ,V C ] is the average value of three-phase voltage; The three-phase currents at multiple sampling points are obtained from the single-day load curve data, and the three-phase currents at the multiple sampling points are used for calculation to obtain the three-term current imbalance rate at each sampling point. Wherein, PIU is the three-term imbalance rate of the current, max[I A ,I B ,I C ] is the maximum value of the three-phase current, min[I A ,I B ,I C ] is the minimum value among the three-phase currents, average[I A ,I B ,I C ] is the average value of three-phase current; The daily load rate, the peak-to-valley difference, the nighttime load ratio, the peak load rate, the average load rate, the valley load rate, the voltage three-item imbalance rate at the multiple sampling time points, and the current three-item imbalance rate at the multiple sampling time points are used as a multidimensional feature vector corresponding to the single-day load curve data; The at least one single-day load curve data is processed respectively to obtain a multidimensional feature vector corresponding to the at least one single-day load curve data, and the multidimensional feature vector corresponding to the at least one single-day load curve data is used as the multidimensional feature data set of the user.

3. The method according to claim 1, characterized in that The isolation forest algorithm is used to calculate the multidimensional feature data set of multiple users to obtain a preliminary screening list of abnormal users, including: Dividing the multidimensional feature data sets of the plurality of users into a plurality of user date samples, each user date sample being a multidimensional feature vector; Acquire multiple features, the features being any one of daily load rate, peak-to-valley difference, nighttime load ratio, peak load rate, flat load rate, valley load rate, voltage three-item imbalance rate, and current three-item imbalance rate; Performing multiple random feature selection and partitioning operations on the multiple user date samples based on the multiple features to obtain multiple groups of forests, each group of the forests including multiple binary trees, and the root node partitioning features of the multiple binary trees are the same; For each user date sample, calculating the path length corresponding to each binary tree in each group of the forests to obtain multiple path lengths corresponding to each group of the forests, calculating an anomaly score corresponding to each group of the forests using the multiple path lengths corresponding to each group of the forests, determining a recognition result of each group of the forests for the user date sample using the anomaly score corresponding to each group of the forests based on a score threshold, and performing an intersection operation on the recognition results of the user date sample based on the multiple groups of forests to obtain a target recognition result for the user date sample; Using the multiple groups of forests to process each of the user date samples respectively, to obtain a target recognition result for each of the user date samples; A plurality of user date samples whose target recognition results indicate abnormalities are selected from the plurality of user date samples as the abnormal user preliminary screening list.

4. The method according to claim 3, characterized in that The performing multiple random feature selection and partitioning operations on the multiple user date samples based on the multiple features to obtain multiple groups of forests includes: arbitrarily selecting one feature from the multiple features as a root node segmentation feature, extracting first feature data corresponding to the root node segmentation feature from the multiple user date samples, determining a root node segmentation point based on the first feature data, and performing the random feature selection and partitioning operation on the multiple user date samples using the root node segmentation point to obtain a first subset and a second subset; arbitrarily selecting one feature from the multiple features as a second segmentation feature, extracting second feature data corresponding to the second segmentation feature from the first subset, determining a second segmentation point based on the second feature data, and performing the random feature selection and partitioning operation on the first subset using the second segmentation point to obtain a third subset and a fourth subset; arbitrarily selecting one feature from the multiple features as a third segmentation feature, extracting third feature data corresponding to the third segmentation feature from the second subset, determining a third segmentation point based on the third feature data, and performing the random feature selection and partitioning operation on the second subset using the third segmentation point to obtain a fifth subset and a sixth subset; Repeat the random feature selection and partitioning operation until it is determined that there is only one sample in the subset after partitioning or the preset depth is reached, stop the random feature selection and partitioning operation to obtain the binary tree, and repeat the process of constructing the binary tree based on the random feature selection and partitioning operation to obtain a group of the forests.

5. The method according to claim 1, wherein The KNN algorithm is used to expand the sample of the abnormal user initial screening list to obtain an abnormal sample data set, including: Randomly extract the abnormal user initial screening list to obtain multiple sub-training sets; Determine a KNN expansion rule for each of the sub-training sets using the KNN algorithm, and perform sample expansion on each of the sub-training sets using the KNN expansion rule for each of the sub-training sets; The multiple sub-training sets after sample expansion are used as the abnormal sample data sets.

6. The method according to claim 1, characterized in that The normal sample data set is obtained, and multi-model integration training is performed using the normal sample data set and the abnormal sample data set to obtain multiple abnormality recognition models, including: Obtaining a preset number, dividing the normal sample data set and the abnormal sample data set into the preset number of sample sets, wherein the ratio of normal samples to abnormal samples in the sample sets is consistent; A preset number of training algorithms are obtained, and model training is performed on the preset number of sample sets using the preset number of training algorithms to obtain the multiple anomaly recognition models.

7. The method according to claim 1, characterized in that The step of sequentially inputting the multidimensional feature dataset of the user to be tested into the multiple anomaly recognition models and determining the target anomaly recognition result of the user to be tested by a voting method includes: Inputting the multidimensional feature data set of the user to be tested into the multiple anomaly recognition models in sequence, and obtaining an anomaly recognition result output by each anomaly recognition model; Using the voting method, counting a first number of abnormal identification results indicating that the user to be tested is a normal user, and a second number of abnormal identification results indicating that the user to be tested is an abnormal user, from a plurality of abnormal identification results; If the first number is greater than the second number, generating a target abnormality recognition result indicating that the user to be tested is a normal user; If the first number is smaller than the second number, a target abnormality recognition result indicating that the user to be tested is an abnormal user is generated.

8. The method according to claim 7, characterized in that The method further comprises: If the first number is equal to the second number, the load curve data of the user to be tested is recalculated, the recalculated multidimensional feature data set is input into the multiple anomaly recognition models in sequence, and the target anomaly recognition result of the user to be tested is re-determined by voting.

9. A device for identifying abnormal electricity consumption behavior based on load curve analysis, characterized in that: include: A calculation module, configured to obtain a load curve data set and calculate a multidimensional feature data set for each user using the load curve data set; An expansion module is used to calculate the multidimensional feature data set of multiple users using the isolation forest algorithm to obtain a preliminary screening list of abnormal users, and to perform sample expansion on the preliminary screening list of abnormal users based on the KNN algorithm to obtain an abnormal sample data set; A training module is used to obtain a normal sample data set, and perform multi-model integration training using the normal sample data set and the abnormal sample data set to obtain multiple abnormality recognition models; The identification module is used to obtain the load curve data of the user to be tested, calculate the multidimensional feature data set of the user to be tested using the load curve data of the user to be tested, input the multidimensional feature data set of the user to be tested into the multiple anomaly recognition models in sequence, and determine the target anomaly recognition result of the user to be tested by voting.

10. A device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images