Power system vulnerability identification method based on data clustering and server

Abstract

The invention provides an electric power system vulnerability identification method based on data clustering and a server, and the method comprises the steps: firstly obtaining an original monitoring data set which is generated by the operation of an electric power system and comprises a plurality of equipment state data units with timestamps, and then carrying out the format unification and noise suppression processing of the original monitoring data set to obtain a preprocessing data set; and then calling a pre-trained clustering analysis model to perform feature association clustering processing on the preprocessed data set, generating a clustering result set containing a vulnerability association cluster and a normal operation cluster, and based on a matching relationship between a vulnerability association cluster feature distribution mode and a preset vulnerability feature library, identifying a vulnerability position and a development stage in the power system. And an early warning instruction containing the vulnerability positioning information and the risk level is generated and sent to the power maintenance terminal to trigger targeted maintenance operation, so that the accuracy and the maintenance efficiency of vulnerability identification of the power system are effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power system operation and maintenance, in particular to a power system vulnerability identification method based on data clustering and a server. BACKGROUND

[0002] In the operation process of the power system, it is crucial to ensure its safety and stability. With the continuous expansion of the scale and the increasing complexity of the power system, potential vulnerabilities existing in the system pose a serious threat to the reliability of power supply. These vulnerabilities may be caused by equipment aging, software failure, external attacks and other factors, and have the characteristics of strong concealment and rapid development.

[0003] Currently, in the field of power system vulnerability identification, traditional methods mainly rely on manual experience judgment or simple rule-based detection mechanisms. However, these methods have obvious limitations. Manual experience judgment is not only inefficient, but also easily affected by personal subjective factors, making it difficult to comprehensively and accurately identify all potential vulnerabilities. Simple rule-based detection mechanisms lack flexibility and cannot adapt to the complex and changing operating environment of the power system, making it difficult to capture some deeply hidden or new feature vulnerabilities. Therefore, there is an urgent need for a more efficient, accurate and intelligent power system vulnerability identification method to improve the security level of the power system. SUMMARY

[0004] In view of the above-mentioned problems, in combination with the first aspect of the present application, the embodiments of the present application provide a power system vulnerability identification method based on data clustering, which comprises: obtaining a set of original monitoring data generated in the operation process of the power system, the set of original monitoring data comprising a plurality of device state data units with timestamp labels; performing format unification and noise suppression processing on the set of original monitoring data to obtain a set of preprocessed data; calling a pre-trained clustering analysis model to perform feature association clustering processing on the set of preprocessed data to generate a set of clustering results comprising vulnerability association clusters and normal operation clusters; based on the matching relationship between the feature distribution pattern of the vulnerability association clusters in the set of clustering results and the preset vulnerability feature library, identifying the vulnerability location and vulnerability development stage existing in the power system; generating an early warning instruction comprising vulnerability positioning information and risk level according to the vulnerability location and vulnerability development stage, and sending the early warning instruction to a power maintenance terminal to trigger targeted maintenance operations.

[0005] In still another aspect, the embodiments of the present application also provide a system for power system vulnerability identification based on data clustering, comprising a processor, a machine readable storage medium, the machine readable storage medium being connected with the processor, the machine readable storage medium being used for storing programs, instructions or codes, and the processor being used for executing the programs, instructions or codes in the machine readable storage medium to realize the above method.

[0006] Based on the above aspects, the embodiments of the present application can effectively improve the quality and availability of data by comprehensively obtaining a set of original monitoring data generated in the operation process of the power system and uniformly processing the format and noise suppression of the data, and can deeply mine the internal relationship between the data by using a pre-trained clustering analysis model to perform feature correlation clustering processing on the preprocessed data, and can accurately distinguish the vulnerability correlation cluster and the normal operation cluster by classifying the data with similar features into a category, and can accurately identify the vulnerability based on the matching relationship between the feature distribution pattern of the vulnerability correlation cluster and the pre-set vulnerability feature library, and can not only accurately locate the vulnerability position in the power system, but also accurately judge the development stage of the vulnerability, and finally generate an early warning instruction containing vulnerability positioning information and risk level, which can be timely and effectively sent to the power maintenance terminal to trigger targeted maintenance operations, greatly improving the timeliness and effectiveness of the vulnerability processing of the power system, and significantly enhancing the safety and stability of the power system. BRIEF DESCRIPTION OF DRAWINGS

[0007] Figure 1 is an execution flow diagram of the method for power system vulnerability identification based on data clustering provided by the embodiments of the present application.

[0008] Figure 2 is a schematic diagram of exemplary hardware and software components of the system for power system vulnerability identification based on data clustering provided by the embodiments of the present application. DETAILED DESCRIPTION

[0009] The present application will be described in detail below with reference to the accompanying drawings, Figure 1 is a flow diagram of the method for power system vulnerability identification based on data clustering provided by an embodiment of the present application, and the method for power system vulnerability identification based on data clustering will be described in detail below.

[0010] Step S110: obtaining a set of original monitoring data generated in the operation process of the power system, wherein the set of original monitoring data comprises a plurality of device state data units with time stamp markers.

[0011] In the actual operation scenario of the power system, in order to realize comprehensive monitoring of the system operation state, monitoring devices can be installed on different types of key power equipment. For example, on the generator in the power generation link, the monitoring device will collect data for multiple key operating parameters. The output voltage parameter can reflect the potential size when the generator delivers power to the grid, and its stability is crucial to the voltage quality of the grid; the output current parameter reflects the transmission capacity of the generator output power, which is closely related to the size of the load; the power factor parameter reflects the efficiency of the generator in using power, and a higher power factor means more efficient power conversion; the winding temperature parameter can be used to judge the heating condition of the internal winding of the generator, and excessive temperature may affect the insulation performance of the generator and even cause failure; the speed parameter plays a key role in maintaining the stable operation of the generator, and stable speed is the basis for ensuring the stability of power frequency.

[0012] On the transformer in the power transformation link, the monitoring device pays attention to the winding temperature, oil level, oil temperature, transformation ratio, no-load loss and load loss, etc. The change of winding temperature can reflect the heating condition inside the transformer, and if the temperature is too high, it may cause accelerated insulation aging; the data of oil level and oil temperature can reflect the cooling and lubrication condition of the transformer, and low oil level or high oil temperature may affect the normal operation of the transformer; the transformation ratio parameter determines the transformation ability of the transformer to voltage, which is the key to realize the conversion of different voltage levels; the no-load loss and load loss data are related to the energy conversion efficiency of the transformer, and excessive loss means waste of energy.

[0013] On the transmission line in the power transmission link, monitoring data such as current, voltage, active power, reactive power and line loss are collected. Current and voltage data are used to measure the transmission capacity of the transmission line, and through monitoring, whether the line is overloaded or voltage is abnormal can be found in time; active power and reactive power data reflect the transmission and distribution of power in the transmission process, and reasonable power distribution is crucial to improve the operation efficiency of the power grid; line loss data reflect the energy loss in the transmission process, and reducing line loss is an important goal to improve the economy of the power grid.

[0014] For the distribution cabinet in the power distribution link, monitoring devices will collect data such as current, voltage, power, etc. to ensure that power can be safely and stably distributed to each user end. Each collected data is accurately time-stamped, which can be accurate to a specific time, and is used to determine the collection time of the data. All these time-stamped device state data units are combined to form the original monitoring data set. The original monitoring data set has multiple dimensions, different types of power equipment correspond to different dimensions of data characteristics, and due to the existence of time stamp, the data shows obvious time series characteristics, which can reflect the changes of the power system operation state at different times.

[0015] Step S120: Format unification and noise suppression processing on the original monitoring data set to obtain a pre-processed data set.

[0016] Since the original monitoring data set is collected by multiple different monitoring devices, which may come from different manufacturers, have different designs and technical specifications, different data formats and sampling frequencies may be used. At the same time, the data may be disturbed by the external environment during transmission and collection, such as electromagnetic interference, signal attenuation, etc., resulting in noise in the data.

[0017] In terms of format unification, the original monitoring data set needs to be identified in detail. Different monitoring devices may save data in various file formats, such as CSV format, JSON format, XML format, etc. In addition, there may be differences in data encoding, storage precision, and data structure. In order to unify these different formats of data, special data conversion algorithms need to be used. For data saved in CSV format, the comma-separated data fields need to be parsed and then reorganized according to the unified format; for JSON format data, the required data needs to be extracted according to its key-value pair structure and then converted; for XML format data, data extraction and conversion need to be performed according to its tag structure. At the same time, the storage precision of the data needs to be uniformly adjusted to ensure that all data have the same precision level and avoid data processing errors caused by precision differences. Finally, all data are converted to binary coded format with fixed length.

[0018] In terms of noise suppression processing, a combination of multiple filtering algorithms is used. Median filtering is a commonly used nonlinear filtering method, which replaces the value of a certain point in the data sequence with the median value in its neighborhood. For a set of device state data units arranged in time order, take each data point and a certain number of data points before and after it, sort these data, and then take the middle value as the new value of the data point. This method can effectively remove impulse noise in the data, because impulse noise usually appears as an abnormal value that is significantly different from the surrounding data, which can be filtered out by taking the median value.

[0019] Wavelet transform is a time-frequency analysis method that can decompose data at different scales and frequencies. In the wavelet transform process, data is decomposed into wavelet coefficients of different frequency components. By thresholding the wavelet coefficients, those considered to be noise are removed, and then wavelet reconstruction is performed to obtain the data after noise removal. Wavelet transform can analyze data at different scales, so it can more effectively separate noise and signal, especially for non-stationary signal processing.

[0020] Kalman filter is an optimal recursive filter that estimates the state of a system by using its state equation and observation equation through two steps of prediction and update. For a device state data unit with dynamic change characteristics, Kalman filter can filter and predict data in real time according to historical information and current observation value of the data, effectively handle random noise and system error in the data, improve the accuracy and stability of the data, and is especially suitable for state estimation of dynamic systems. After format unification and noise suppression processing, the data quality of the preprocessed data set is significantly improved, which is more suitable for subsequent analysis and processing.

[0021] Step S130: calling a pre-trained clustering analysis model to perform feature correlation clustering processing on the preprocessed data set to generate a clustering result set containing vulnerability correlation clusters and normal operation clusters.

[0022] In this embodiment, the pre-trained clustering analysis model is trained based on a large amount of historical power system operation data. In the training stage, power system operation data under normal operation state and various known vulnerability states are collected, and these power system operation data are labeled in detail. The normal operation data are labeled as normal category, and the vulnerability data are classified and labeled according to different vulnerability types, such as device failure vulnerability, network attack vulnerability, etc.

[0023] The training process needs to continuously adjust the parameters of the clustering analysis model so that the clustering analysis model can accurately learn the feature patterns of normal operation data and vulnerability data. In the training process, stochastic gradient descent algorithm and its variants such as Adagrad, Adadelta, Adam, etc. are used. These algorithms can dynamically adjust the parameters of the model according to the loss function value of the model, so that the loss function value gradually decreases, thereby improving the performance of the model. The loss function is used to measure the difference between the predicted results of the model and the true labels. By minimizing the loss function, the predicted results of the clustering analysis model can be made closer to the true situation.

[0024] When the preprocessed data set is obtained, it is input into the clustering analysis model. The clustering analysis model will group similar data together to form different clusters according to the features of the device state data units in the preprocessed data set through calculation and analysis. Among them, the vulnerability correlation cluster contains data units related to the vulnerability of the power system, and the feature patterns of these data units have obvious differences with the normal operation data; the normal operation cluster contains data units reflecting the normal operation state of the power system, and the feature patterns of these data units conform to the rules of the normal operation of the power system.

[0025] Step S131: inputting the preprocessed data set into a time sequence feature extraction module of the clustering analysis model, and extracting time sequence features of the device state data units by a bidirectional long short-term memory network to generate dynamic feature vectors with time sequence dependence.

[0026] Step S1311: arranging the preprocessed data set in a time stamp order into a time sequence data sequence containing a plurality of device state data units collected continuously.

[0027] In order to accurately extract the time sequence features of the device state data units, the preprocessed data set needs to be arranged in the order of time stamps accurately. The sorting process needs to ensure the time continuity and order of the preprocessed data set, and avoid the loss of time sequence information caused by sorting errors. By sorting the preprocessed data set according to the time stamp, a time sequence data sequence containing a plurality of device state data units collected continuously is generated. Each data unit in the time sequence data sequence has a time sequence relationship with the previous and subsequent data units, and can reflect the change of the operation state of the power system in a period of time.

[0028] Step S1312: inputting the time sequence data sequence into a forward propagation layer of the bidirectional long short-term memory network, and processing each device state data unit in turn from front to back to extract the future context features of each device state data unit and the subsequent device state data units.

[0029] The forward propagation layer of the bidirectional long short-term memory network (Bi-LSTM) is a neural network structure for processing time sequence data. In the forward propagation process, the bidirectional long short-term memory network processes each device state data unit in the time sequence data sequence in turn from front to back. Each neuron of the Bi-LSTM network contains four key parts: an input gate, a forget gate, an output gate and a cell state.

[0030] For each data unit, the input gate determines how much new information can enter the cell state according to the current input data and the hidden state at the previous time. The forget gate determines which information in the cell state needs to be forgotten according to the current input data and the hidden state at the previous time. The output gate determines which information in the cell state can be output as the hidden state at the current time according to the current cell state and the hidden state at the previous time. In this way, the forward propagation layer can continuously update the cell state and the hidden state, thereby extracting the future context features of each device state data unit and the subsequent device state data units. For example, for the output power data of the generator, the forward propagation layer can learn the trend of the power in the future period of time.

[0031] Step S1313: input the time series data sequence into the back propagation layer of the bidirectional long short-term memory network, process each device state data unit from back to front, and extract the historical context features of each device state data unit and the previous device state data unit.

[0032] In contrast to the forward propagation layer, the back propagation layer processes each device state data unit in the time series data sequence from back to front. Similarly, each neuron of the back propagation layer also includes an input gate, a forget gate, an output gate, and a cell state. When processing each data unit, the input gate, the forget gate, and the output gate are calculated according to the current input data and the hidden state at the next time, and the cell state and the hidden state are updated. In this way, the back propagation layer can extract the historical context features of each device state data unit and the previous device state data unit. For example, for the winding temperature data of the transformer, the back propagation layer can learn the temperature change in the past period of time.

[0033] Step S1314: perform an element-wise addition operation on the future context features output by the forward propagation layer and the historical context features output by the back propagation layer through the state merging layer of the bidirectional long short-term memory network to generate joint context features containing complete time context information.

[0034] The role of the state merging layer of the bidirectional long short-term memory network is to merge the future context features output by the forward propagation layer and the historical context features output by the back propagation layer. In the merging process, an element-wise addition operation is adopted, that is, the elements at corresponding positions in the future context features and the historical context features are added to obtain new joint context features. The above merging method can make the joint context features contain complete time context information, considering both the future trend of the data and the historical change of the data.

[0035] Step S1315: perform dimension compression processing on the joint context features, map the high-dimensional features to a dynamic feature vector in a low-dimensional vector space through a fully connected layer, and the dynamic feature vector retains the time sequence variation law of the device state data unit.

[0036] In order to reduce the dimension of the features and improve the efficiency of subsequent processing, dimension compression processing needs to be performed on the joint context features. The fully connected layer is a commonly used neural network layer, which can linearly combine the input high-dimensional features through a set of weight matrices, and map them to a dynamic feature vector in a low-dimensional vector space. In this process, the fully connected layer learns important information in the high-dimensional features and retains it in the low-dimensional vector. The final obtained dynamic feature vector retains the time sequence variation law of the device state data unit, which can reflect the running state change of the power system in the time dimension.

[0037] Step S132: inputting the dynamic feature vector into a spatial feature fusion module of the clustering analysis model, performing weighted fusion on the spatial position correlation features of different device type data units through an attention mechanism, and generating multi-dimensional fusion features containing both time correlation and spatial correlation.

[0038] Step S1321: extracting device spatial position information corresponding to each device state data unit in the dynamic feature vector, the device spatial position information including physical installation coordinates of the device in the power system.

[0039] After obtaining the dynamic feature vector, the device spatial position information corresponding to each device state data unit needs to be extracted therefrom. The device spatial position information refers to the physical installation coordinates of the device in the power system, which can accurately represent the specific position of the device in the power system. For example, a generator may be installed in a specific area of a power station, a transformer may be installed in a specific location of a substation, and a transmission line may be laid along a specific path. By obtaining the physical installation coordinates of these devices, the spatial position relationship between them can be determined.

[0040] Step S1322: calculating the spatial distance between different device type data units according to the device spatial position information, and constructing an inter-device spatial correlation matrix according to the spatial distance, the element value in the inter-device spatial correlation matrix representing the spatial proximity degree between devices.

[0041] After obtaining the device spatial position information, the spatial distance between different device type data units needs to be calculated. The spatial distance can be calculated using methods such as Euclidean distance and Manhattan distance. Taking Euclidean distance as an example, for the physical installation coordinates of two devices, the spatial distance can be obtained by calculating the straight-line distance in three-dimensional space. According to the calculated spatial distance, an inter-device spatial correlation matrix can be constructed. The element value in the inter-device spatial correlation matrix represents the spatial proximity degree between devices, and generally the closer the distance between devices, the larger the corresponding element value in the inter-device spatial correlation matrix, indicating that the spatial correlation between them is closer.

[0042] Step S1323: inputting the dynamic feature vector and the inter-device spatial correlation matrix into an attention mechanism module, and calculating the attention weight of each device state data unit to the target data unit through dot product operation of query vector and key vector.

[0043] The attention mechanism module assigns different attention weights to each device state data unit according to the degree of spatial correlation between devices. In the attention mechanism, the dynamic feature vector and the spatial correlation matrix between devices are input. First, the query vector, key vector and value vector are generated from the dynamic feature vector. Then, the attention weight of each device state data unit to the target data unit is calculated by the dot product operation of the query vector and the key vector. The attention weight represents the importance of each device state data unit in the fusion process, and the greater the weight, the greater the influence of the data unit on the target data unit.

[0044] Step S1324: Weighted sum processing is performed on the dynamic feature vector according to the attention weight, to generate a spatial context enhanced feature of each device state data unit, which reflects the state influence of neighboring devices on the target device.

[0045] After obtaining the attention weight, the dynamic feature vector is weighted and summed according to the weight. Specifically, the dynamic feature vector of each device state data unit is multiplied by its corresponding attention weight, and then all the results are added to obtain the spatial context enhanced feature of each device state data unit. The spatial context enhanced feature reflects the state influence of neighboring devices on the target device, and by introducing spatial position information, the interaction between devices can be better captured.

[0046] Step S1325: The spatial context enhanced feature and the original dynamic feature vector are spliced along the feature dimension to generate a multi-dimensional fusion feature containing both temporal correlation and spatial correlation.

[0047] Finally, the spatial context enhanced feature and the original dynamic feature vector are spliced along the feature dimension. The splicing process is to connect two feature vectors in the feature dimension to form a new multi-dimensional feature vector. The multi-dimensional fusion feature generated by this process contains both temporal correlation and spatial correlation information, considering both the time series change of device state data units and the spatial position relationship between devices, and can more comprehensively reflect the operation state of the power system.

[0048] Step S133: The multi-dimensional fusion feature is input into the adaptive clustering module of the clustering analysis model to automatically identify the concentrated and dispersed regions of data distribution in the feature space by the density peak clustering algorithm.

[0049] Step S1331: Calculate the Euclidean distance between each data unit in the multi-dimensional fusion feature and all other data units to generate a distance matrix in the feature space.

[0050] After the multi-dimensional fusion features are input into the self-adaptive clustering module, the Euclidean distance between each data unit in the feature space and all other data units needs to be calculated first. The Euclidean distance is a commonly used distance measurement method, which can measure the distance between two data units in the feature space. For each data unit in the multi-dimensional fusion features, it is compared with all other data units to calculate the Euclidean distance between them. All the calculated Euclidean distances form a distance matrix in the feature space. The elements in the distance matrix represent the distance between any two data units, and the distribution of the data in the feature space can be understood through the distance matrix.

[0051] Step S1332: Calculate the local density value of each data unit according to the distance matrix, the local density value being the number of other data units having a distance less than the cutoff distance from the data unit.

[0052] After obtaining the distance matrix, the local density value of each data unit needs to be calculated. The local density value refers to the number of other data units having a distance less than the cutoff distance from the data unit. The cutoff distance is a pre-set parameter used to determine the neighborhood range of the data unit. For each data unit, the distance matrix is traversed to count the number of data units having a distance less than the cutoff distance from the data unit, and this number of data units is the local density value of the data unit. The local density value reflects the data distribution density around the data unit, and the greater the density value, the denser the data around the data unit.

[0053] Step S1333: Calculate the relative distance value of each data unit, the relative distance value being the minimum distance between the data unit and the data unit having a local density value greater than itself.

[0054] In addition to the local density value, the relative distance value of each data unit also needs to be calculated. The relative distance value refers to the minimum distance between the data unit and the data unit having a local density value greater than itself. For each data unit, first find the data unit having a local density value greater than itself, then calculate the distance between the data unit and these data units, and take the minimum value as the relative distance value. The relative distance value reflects the relative position of the data unit in the feature space, and the data unit with a larger relative distance value may be a boundary point or an isolated point of data distribution.

[0055] Step S1334: Identify the data unit having both the local density value and the relative distance value greater than the pre-set threshold as a cluster center candidate point.

[0056] After obtaining the local density and relative distance values ​​for each data unit, cluster center candidate points need to be identified based on a preset threshold. This threshold is determined empirically or experimentally to select data units with high local density and relative distance. Data units with both local density and relative distance values ​​exceeding the preset threshold are marked as cluster center candidate points. These candidate points are typically located in the central area of ​​the data distribution and are highly representative.

[0057] Step S1335: Taking the cluster center candidate point as the core, allocating data units with local density values ​​smaller than the core point and closest to the core point to the corresponding cluster, generating an initial clustering result including concentrated areas and dispersed areas.

[0058] After determining the candidate points for the cluster centers, clustering operations are performed with these candidate points as the core. For each candidate point for the cluster center, the data units whose local density values ​​are smaller than its core point and are closest to the core point are assigned to the corresponding cluster. Specifically, for each candidate point for the cluster center, all data units whose local density values ​​are smaller than it are traversed, the distances between these data units and the candidate point for the cluster center are calculated, and the data units with the closest distances are divided into clusters with the candidate point as the core. Through such operations, all data units are assigned to different clusters, thereby generating an initial clustering result containing concentrated areas and dispersed areas. Concentrated areas refer to areas where data units are relatively dense, which usually correspond to the normal operation of the power system; dispersed areas refer to areas where data units are sparsely distributed, which may be related to vulnerabilities in the power system.

[0059] Step S1336: performing boundary point adjustment processing on the initial clustering result, reallocating data units that belong to the boundaries of two clusters to the cluster with higher local density value, and obtaining the final concentrated area and dispersed area division result.

[0060] For example, step S13361: traverse all boundary data units in the initial clustering result, where the boundary data units are device status data units that are covered by the cluster centers of two clusters at the same time.

[0061] After obtaining the initial clustering results, it is necessary to adjust the boundary data units. Boundary data units are those device status data units that are covered by the cluster centers of both clusters. The ownership of these data units may be uncertain. To more accurately delineate concentrated and dispersed areas, these boundary data units need to be reallocated. By traversing all data units in the initial clustering results, find those that meet the condition of being covered by the cluster centers of both clusters and mark them as boundary data units.

[0062] Step S13362: Extract the local density values of each boundary data unit and two associated cluster centers, the local density value being the number of data units within a preset range around the cluster center.

[0063] For each boundary data unit, the local density values of the two associated cluster centers need to be extracted. The method of calculating the local density value is to count the number of data units within a preset range around the cluster center. The preset range is a pre-set distance threshold for determining the neighborhood range of the cluster center. For each boundary data unit, the number of data units within the preset range of the two associated cluster centers to which it belongs is calculated respectively, and two local density values are obtained. The two local density values reflect the data distribution density of the two clusters near the boundary data unit.

[0064] Step S13363: Compare the local density values of the two cluster centers, and assign the boundary data unit to the cluster with higher local density value.

[0065] After obtaining the two local density values corresponding to each boundary data unit, the two values are compared. The boundary data unit is assigned to the cluster with higher local density value, which can make the data division more reasonable and make the data in each cluster more closely gathered together. Because the cluster with higher local density value indicates that the data distribution in this region is more dense, assigning the boundary data unit to this cluster can better reflect the concentration of data.

[0066] Step S13364: Recalculate the cluster centers of the two clusters after reassignment, the cluster center being the feature mean value of all data units in the cluster.

[0067] After reassigning the boundary data unit to the cluster with higher local density value, the cluster centers of the two clusters need to be recalculated. The cluster center refers to the feature mean value of all data units in the cluster. By averaging the values of each feature dimension of all data units in the cluster, a new cluster center is obtained. Recalculating the cluster center can make the center of the cluster more accurately reflect the concentration trend of the data in the cluster.

[0068] Step S13365: Check the feature dispersion of the two clusters after reassignment, the feature dispersion being the average distance between the data units in the cluster and the cluster center.

[0069] In order to evaluate the rationality of the clustering result after reassignment, the feature dispersion of the two clusters needs to be checked. The feature dispersion refers to the average distance between the data units in the cluster and the cluster center, which reflects the dispersion degree of the data in the cluster. For each cluster, the distances between all data units in the cluster and the cluster center are calculated, and then the average of these distances is calculated to obtain the feature dispersion of the cluster. By comparing the feature dispersion with the preset dispersion threshold, it can be judged whether the clustering result meets the requirements.

[0070] Step S13366: If the concentration region dispersion is less than the preset dispersion threshold and the dispersion region dispersion is greater than the preset dispersion threshold, output the final division result; otherwise, repeat the boundary data unit allocation and cluster center calculation steps until the threshold conditions are met.

[0071] The feature dispersions of the concentration region and the dispersion region are compared with the preset dispersion threshold. If the dispersion of the concentration region is less than the preset dispersion threshold, it indicates that the data units in the concentration region are relatively concentrated, which is consistent with the data aggregation characteristics in the normal operating state. At the same time, if the dispersion of the dispersion region is greater than the preset dispersion threshold, it indicates that the data units in the dispersion region are relatively dispersed, which may be related to vulnerabilities. When both conditions are met, it is considered that the clustering result meets the expected effect, and the final concentration region and dispersion region division result is output. If the above conditions are not met, the steps of boundary data unit allocation and cluster center calculation need to be repeated, and the allocation of data units is continuously adjusted until the dispersions of the concentration region and the dispersion region meet the preset threshold conditions.

[0072] Step S134: Define the concentration region as a normal operation cluster and the dispersion region as a vulnerability associated cluster, and the vulnerability associated cluster contains data units whose feature distribution deviates from the normal operation mode.

[0073] After the division of the concentration region and the dispersion region is completed, according to the characteristics of the power system operation and the characteristics of the clustering result, the concentration region is defined as a normal operation cluster. The data units in the concentration region are relatively dense, and their feature distribution is consistent with the mode of normal operation of the power system, indicating that the device states corresponding to these data are in a normal operating state. The dispersion region is defined as a vulnerability associated cluster, and the data units in the dispersion region are relatively sparse, and their feature distribution deviates from the normal operation mode, which may be due to the existence of vulnerabilities in the power system causing abnormal changes in device states. These data units that deviate from the normal operation mode contain information related to vulnerabilities, and through further analysis of the vulnerability associated cluster, the vulnerabilities existing in the power system can be identified.

[0074] Step S135: Perform boundary optimization processing on the normal operation cluster and the vulnerability associated cluster, adjust the cluster center position through iteration to make the feature dispersion of the data units in the vulnerability associated cluster greater than the preset threshold, and generate a final clustering result set.

[0075] Step S1351: Calculate the initial cluster center of the normal operation cluster, and the initial cluster center is the feature mean of all data units in the normal operation cluster.

[0076] First, the initial cluster center of the normal operation cluster needs to be calculated. The cluster center refers to the feature mean of all data units in the cluster. For all data units in the normal operation cluster, the values of each feature dimension are summed and then divided by the number of data units to obtain the average value of each feature dimension. The vector composed of these average values is the initial cluster center of the normal operation cluster. The initial cluster center represents the concentration trend of data in the normal operation cluster and provides a benchmark for subsequent boundary optimization processing.

[0077] Step S1352: Calculate the initial cluster center of the vulnerability correlation cluster, which is the feature mean of all data units in the vulnerability correlation cluster.

[0078] Similarly, for the vulnerability correlation cluster, its initial cluster center also needs to be calculated. According to the same method as calculating the initial cluster center of the normal operation cluster, the average value of each feature dimension of all data units in the vulnerability correlation cluster is calculated to obtain the initial cluster center of the vulnerability correlation cluster. The initial cluster center reflects the concentration of data in the vulnerability correlation cluster and is an important basis for boundary optimization processing.

[0079] Step S1353: Calculate the average distance between the data units in the vulnerability correlation cluster and the initial cluster center of the vulnerability correlation cluster as the initial dispersion.

[0080] To evaluate the dispersion of data in the vulnerability correlation cluster, the average distance between the data units in the vulnerability correlation cluster and the initial cluster center of the vulnerability correlation cluster is calculated, and this average distance is taken as the initial dispersion. Specifically, for each data unit in the vulnerability correlation cluster, the distance between it and the initial cluster center is calculated, and then all distances are added and divided by the number of data units to obtain the initial dispersion. The initial dispersion reflects the dispersion of data in the vulnerability correlation cluster relative to the cluster center and is an important indicator for determining whether further adjustment is needed.

[0081] Step S1354: If the initial dispersion is less than a preset threshold, the data unit farthest from the initial cluster center of the vulnerability correlation cluster is reassigned to the normal operation cluster, and the cluster center and dispersion of the vulnerability correlation cluster are recalculated.

[0082] The initial dispersion is compared with a preset dispersion threshold value. If the initial dispersion is less than the preset threshold value, it indicates that the data units in the vulnerability correlation cluster are relatively concentrated, and some data units originally in the normal operation state may be misclassified into the vulnerability correlation cluster. In order to optimize the clustering result, the data unit farthest from the initial cluster center of the vulnerability correlation cluster is re-assigned to the normal operation cluster. Then, the cluster center of the vulnerability correlation cluster is recalculated, and the data units in the vulnerability correlation cluster after re-assignment are averaged according to the method of calculating the cluster center to obtain a new cluster center. At the same time, the dispersion of the vulnerability correlation cluster is recalculated, and the dispersion of the data is evaluated again.

[0083] Step S1355: The re-assignment and re-calculation operations are repeated until the dispersion of the vulnerability correlation cluster is greater than or equal to the preset threshold value or the number of data units is less than the minimum cluster size. The finally adjusted normal operation cluster and vulnerability correlation cluster are output as the final clustering result set.

[0084] The re-assignment of data units and the re-calculation of cluster centers and dispersion are repeatedly performed. After each operation, the dispersion of the vulnerability correlation cluster is compared with the preset threshold value. If the dispersion of the vulnerability correlation cluster is greater than or equal to the preset threshold value, it indicates that the data units in the vulnerability correlation cluster are sufficiently dispersed, which meets the characteristics of data in the vulnerability state. Or when the number of data units in the vulnerability correlation cluster is less than the minimum cluster size, it indicates that there are few data in the cluster, and further adjustment is not meaningful. When any of the two conditions is met, the iteration operation is stopped, and the finally adjusted normal operation cluster and vulnerability correlation cluster are output as the final clustering result set, which accurately classifies the data into normal operation clusters and vulnerability correlation clusters.

[0085] Step S140: Based on the matching relationship between the feature distribution pattern of the vulnerability correlation cluster in the clustering result set and the preset vulnerability feature library, the location and development stage of the vulnerability in the power system are identified.

[0086] Step S141: The feature mean, feature variance, and feature change rate of all device state data units in the vulnerability correlation cluster are extracted to construct the feature distribution pattern of the vulnerability correlation cluster.

[0087] For all device state data units in the vulnerability correlation cluster, the feature mean, feature variance and feature change rate need to be extracted. The feature mean refers to the average value of all data units in the cluster in each feature dimension, which reflects the concentration trend of the data in the cluster. The feature variance refers to the dispersion degree of the data units in each feature dimension relative to the feature mean, which reflects the fluctuation of the data. The feature change rate refers to the change speed of the feature value of the data unit in the time dimension, which is obtained by calculating the difference between the feature values at adjacent time points and dividing by the time interval. The feature mean, feature variance and feature change rate are combined to construct the feature distribution pattern of the vulnerability correlation cluster, which can comprehensively describe the statistical characteristics and change law of the data in the vulnerability correlation cluster.

[0088] Step S142: Obtain the standard feature distribution pattern corresponding to different vulnerability types from the preset vulnerability feature library, wherein the standard feature distribution pattern includes feature distribution parameters of the initial stage, the middle stage and the final stage of the vulnerability.

[0089] The preset vulnerability feature library is a pre-established database that stores standard feature distribution patterns of different vulnerability types in different development stages. These standard feature distribution patterns are obtained based on a large amount of historical data and actual case analysis, and include feature distribution parameters of the initial stage, the middle stage and the final stage of the vulnerability. The standard feature distribution pattern of each vulnerability type records in detail the mean range, variance range and feature change rate trend of each feature dimension of the vulnerability in different development stages. These standard feature distribution patterns are obtained from the preset vulnerability feature library to match the feature distribution pattern of the vulnerability correlation cluster.

[0090] Step S143: Calculate the cosine similarity between the feature distribution pattern of the vulnerability correlation cluster and each standard feature distribution pattern, and determine the standard feature distribution pattern with the highest similarity as the matching pattern.

[0091] In order to find the standard feature distribution pattern that best matches the feature distribution pattern of the vulnerability correlation cluster, the cosine similarity between them needs to be calculated. Cosine similarity is a commonly used similarity measurement method, which measures the similarity between two vectors by calculating the cosine of the included angle. The feature distribution pattern of the vulnerability correlation cluster and each standard feature distribution pattern in the preset vulnerability feature library are regarded as vectors, and the cosine similarity between them is calculated. The closer the value of the cosine similarity is to 1, the more similar the two vectors are. By comparing all the cosine similarity values, the standard feature distribution pattern with the highest similarity is determined as the matching pattern. The vulnerability type corresponding to the matching pattern is the possible vulnerability type in the power system.

[0092] Step S144: determining the location of the vulnerability existing in the power system according to the vulnerability type corresponding to the matching pattern, the location of the vulnerability being located by the device identification information associated with the matching pattern.

[0093] After the matching pattern is determined, the location of the vulnerability existing in the power system can be further determined according to the vulnerability type corresponding to the matching pattern. Each standard feature distribution pattern in the preset vulnerability feature library is associated with corresponding device identification information, and these device identification information can be accurately located to specific devices in the power system. Through the device identification information associated with the matching pattern, the location of the device where the vulnerability may exist can be accurately found, such as a specific generator, transformer or transmission line, etc.

[0094] Step S145: analyzing the degree of coincidence between the vulnerability associated cluster feature distribution pattern and the feature distribution parameters in different development stages in the matching pattern, and identifying the vulnerability development stage where the vulnerability currently locates, the vulnerability development stage including an initial stage, a middle stage and a final stage.

[0095] Step S1451: obtaining a feature distribution parameter group corresponding to the vulnerability initial stage, the vulnerability middle stage and the vulnerability final stage in the matching pattern respectively, the feature distribution parameter group including a feature mean fluctuation range, a feature variance stable interval and a feature change rate trend.

[0096] The feature distribution parameter group corresponding to the vulnerability initial stage, the vulnerability middle stage and the vulnerability final stage is obtained from the matching pattern. Each feature distribution parameter group includes the feature mean fluctuation range, the feature variance stable interval and the feature change rate trend of each feature dimension in the stage. The feature mean fluctuation range defines the possible value range of the feature mean in the stage, the feature variance stable interval indicates the stable state of the feature variance in the stage, and the feature change rate trend describes the change direction and speed of the feature value over time in the stage.

[0097] Step S1452: extracting the actual mean, the actual variance and the actual rate in the feature distribution pattern of the vulnerability associated cluster as the to-be-compared features.

[0098] The actual mean, the actual variance and the actual rate are extracted from the feature distribution pattern of the vulnerability associated cluster, and these values are taken as the to-be-compared features. The actual mean is the actual average value of the data units in the vulnerability associated cluster in each feature dimension, the actual variance is the actual dispersion degree of the data units relative to the actual mean, and the actual rate is the actual change speed of the feature value of the data units in the time dimension. These to-be-compared features reflect the actual feature situation of the current vulnerability associated cluster, and will be used for comparison with the feature distribution parameter groups in different development stages in the matching pattern.

[0099] Step S1453: Match the to-be-compared features with the feature distribution parameter sets of each stage respectively, and count the number of times that the mean value falls within the corresponding fluctuation range, the number of times that the variance falls within the corresponding stable interval, and the number of times that the rate conforms to the corresponding trend, to generate the number of initial matching items, the number of intermediate matching items, and the number of final matching items.

[0100] The to-be-compared features are matched with the feature distribution parameter sets of the initial stage, the intermediate stage, and the final stage of the vulnerability in the matching mode respectively. For the feature distribution parameter set of each stage, it is checked whether the actual mean value in the to-be-compared features falls within the fluctuation range of the mean value of the features of the stage. If it falls within the range, it is counted as one match. It is checked whether the actual variance falls within the stable interval of the variance of the features of the stage. If it falls within the interval, it is counted as one match. It is checked whether the actual rate conforms to the trend of the change rate of the features of the stage. If it conforms, it is counted as one match. The number of matches in the initial stage, the intermediate stage, and the final stage of the vulnerability is counted respectively, to obtain the number of initial matching items, the number of intermediate matching items, and the number of final matching items.

[0101] Step S1454: Determine the stage with the most matching items as the preliminary stage.

[0102] The sizes of the number of initial matching items, the number of intermediate matching items, and the number of final matching items are compared, and the stage with the most matching items is determined as the preliminary stage. The preliminary stage is obtained based on the direct matching results of the to-be-compared features and the feature distribution parameter sets of each stage, which preliminarily judges the current development stage of the vulnerability.

[0103] Step S1455: Extract the feature evolution sequence of the vulnerability correlation cluster arranged according to the timestamp, which includes the mean value change curve, the variance change curve, and the rate change curve.

[0104] In order to more accurately judge the development stage of the vulnerability, the feature evolution sequence of the vulnerability correlation cluster arranged according to the timestamp is extracted. The feature evolution sequence refers to the sequence of the feature values of the data units in the vulnerability correlation cluster changing over time, including the mean value change curve, the variance change curve, and the rate change curve. The mean value change curve records the change of the feature mean value of the data units in the vulnerability correlation cluster at each time point, the variance change curve reflects the fluctuation of the feature variance over time, and the rate change curve shows the change trend of the feature change rate over time. These curves can directly show the evolution process of the features of the vulnerability correlation cluster in the time dimension.

[0105] Step S1456: Obtain the evolution reference curve corresponding to each stage in the matching mode, calculate the shape similarity between the feature evolution sequence and each reference evolution curve, and select the stage corresponding to the reference evolution curve with the highest similarity as the verification stage.

[0106] The evolution reference curves corresponding to the early stage, the middle stage and the late stage of the vulnerability are obtained from the matching mode. These evolution reference curves are based on a large amount of historical data and actual cases, and represent the typical mode of the characteristics evolution of the vulnerability in different development stages. The shape similarity between the feature evolution sequence of the vulnerability correlation cluster and each reference evolution curve is calculated. The shape similarity can be measured by comparing the shape, trend and fluctuation of the two curves. The stage corresponding to the reference evolution curve with the highest similarity is selected as the verification stage. The verification stage is a further verification of the preliminary stage from the perspective of feature evolution.

[0107] Step S1457: If the preliminary stage is consistent with the verification stage, output the stage; if not, select the stage with the maximum sum of the number of matching items and the similarity as the final identification stage.

[0108] Compare the preliminary stage and the verification stage. If they are consistent, it means that the results based on the feature distribution parameter matching and the feature evolution curve matching are consistent, and the stage is directly output as the development stage of the vulnerability at present. If the preliminary stage is inconsistent with the verification stage, the number of matching items and the shape similarity need to be considered comprehensively. Calculate the sum of the number of matching items and the shape similarity of each stage, and select the stage with the maximum sum as the final identification stage. The final identification stage integrates the results of the feature distribution parameter matching and the feature evolution curve matching, and more accurately reflects the development stage of the vulnerability at present.

[0109] Step S150: According to the vulnerability position and the vulnerability development stage, a warning instruction containing vulnerability positioning information and risk level is generated, and the warning instruction is sent to the power maintenance terminal to trigger targeted maintenance operation.

[0110] Step S151: Obtain the device type information corresponding to the vulnerability position and the functional importance level of the device in the power system, wherein the functional importance level is divided according to the influence degree of the device on the stable operation of the system.

[0111] After determining the location of the vulnerability, the device type information corresponding to the vulnerability location and the functional importance level of the device in the power system need to be obtained. The device type information can clearly indicate whether the device is a generator, a transformer, a transmission line, or other types of devices. Different types of devices have different functions and roles in the power system. The functional importance level is classified according to the degree of influence of the device on the stable operation of the power system. For example, the generator is the core device of the power system, and its normal operation is crucial to power generation. Once a fault occurs, it may cause a large-scale power outage, so the functional importance level of the generator is high. Some auxiliary devices, such as small monitoring sensors, also have some effect on the operation of the power system, but their influence on the stable operation of the system is relatively small, so their functional importance level is low. By evaluating and classifying the functions and roles of devices in the power system, the functional importance level of each device can be determined.

[0112] Step S152: Determine the risk base level of the vulnerability according to the vulnerability development stage, the risk base level increasing from the initial stage to the final stage.

[0113] The risk base level of the vulnerability is closely related to the development stage of the vulnerability. Generally speaking, in the initial stage, the influence range and harm degree of the vulnerability are relatively small, and the risk base level is also low. In this stage, the vulnerability may just begin to appear, and its influence on the operation state of the power system is not obvious, and it may only be some minor abnormal conditions. As the vulnerability develops into the middle stage, its influence range gradually expands, and it may have already interfered with some parts of the power system, causing device performance degradation or some abnormal functions, so the risk base level increases. When the vulnerability develops to the final stage, its harm degree reaches the maximum, which may cause damage to power equipment, failure of transmission lines, or even collapse of the entire power system, so the risk base level is the highest. According to the development stage of the vulnerability, the risk base level of the vulnerability can be determined according to the pre-set corresponding relationship.

[0114] Step S153: Calculate the comprehensive risk level of the vulnerability by combining the functional importance level and the risk base level, the comprehensive risk level being determined by weighted sum of the importance level and the base level.

[0115] For example, step S1531: Obtain the weight coefficient corresponding to the functional importance level, the weight coefficient increasing with the increase of the influence of the device on the stable operation of the system.

[0116] In order to accurately calculate the comprehensive risk level of the vulnerability, a corresponding weight coefficient needs to be assigned to the function importance level. The size of the weight coefficient reflects the importance of the device function importance in the comprehensive risk assessment. For devices with a higher function importance level, the corresponding weight coefficient is larger, because these devices have a greater impact on the stable operation of the power system once a vulnerability occurs; and for devices with a lower function importance level, the corresponding weight coefficient is smaller. The determination of the weight coefficient is based on in-depth analysis and evaluation of the functions and roles of different devices in the power system, and the weight coefficient will increase as the impact of the device on the stable operation of the system increases.

[0117] Step S1532: Obtain the base score corresponding to the risk base level, and the base score increases from the initial stage to the final stage of vulnerability development.

[0118] Each risk base level corresponds to a base score, and the base score is determined according to the degree of harm of the vulnerability at different development stages. In the initial stage of the vulnerability, the corresponding base score is also low due to the relatively low degree of harm; as the vulnerability develops to the middle stage, the degree of harm increases, and the base score also increases accordingly; in the final stage of the vulnerability, the degree of harm reaches the maximum, and the base score is also the highest. By consulting the pre-set corresponding relationship table of risk base level and base score, the base score corresponding to the current vulnerability risk base level can be obtained.

[0119] Step S1533: Multiply the weight coefficient and the base score to obtain the comprehensive risk score of the vulnerability.

[0120] The weight coefficient corresponding to the function importance level and the base score corresponding to the risk base level are multiplied to obtain the comprehensive risk score of the vulnerability. The comprehensive risk score takes into account the function importance of the device and the impact of the development stage of the vulnerability on the power system. For example, if a device with a higher function importance level has a vulnerability in the final stage, the comprehensive risk score obtained by multiplying the large weight coefficient and the high base score will also be high, indicating that the vulnerability has a great harm to the power system.

[0121] Step S1534: According to the pre-set risk level division interval, map the comprehensive risk score to a specific comprehensive risk level.

[0122] A series of risk level division intervals are preset, and each interval corresponds to a specific comprehensive risk level. According to the calculated comprehensive risk score, it is judged which risk level division interval it falls into, so as to map the comprehensive risk score to a specific comprehensive risk level. For example, the risk level division intervals can be divided into a low risk interval, a medium risk interval and a high risk interval. When the comprehensive risk score falls in the low risk interval, the corresponding comprehensive risk level is low risk; when it falls in the medium risk interval, the comprehensive risk level is medium risk; and when it falls in the high risk interval, the comprehensive risk level is high risk.

[0123] Step S1535: Extract the feature change frequency of the device state data unit in the vulnerability associated cluster, and the feature change frequency is the number of times of change of the feature value in a unit time.

[0124] In order to further adjust the comprehensive risk level, it is necessary to extract the feature change frequency of the device state data unit in the vulnerability associated cluster. The feature change frequency refers to the number of times of change of the feature value of the device state data unit in a unit time. For example, for the output power feature of the generator, the number of times of change of the power value in one hour is counted, so as to obtain the change frequency of the output power feature. The feature change frequency reflects the activity degree of the vulnerability. The higher the feature change frequency, the more frequent the influence of the vulnerability on the device state, which may mean that the harm degree of the vulnerability is increasing.

[0125] Step S1536: If the feature change frequency is greater than a preset frequency threshold, the comprehensive risk level is adjusted by one level upwards, and if it is less than or equal to the preset frequency threshold, the comprehensive risk level remains unchanged, and finally an adjusted comprehensive risk level is generated.

[0126] The extracted feature change frequency is compared with the preset frequency threshold. If the feature change frequency is greater than the preset frequency threshold, it means that the activity degree of the vulnerability is high, and the influence on the power system may be more serious than the previous evaluation. At this time, the comprehensive risk level is adjusted by one level upwards. For example, if the original comprehensive risk level is medium risk, it is adjusted to high risk after adjustment. If the feature change frequency is less than or equal to the preset frequency threshold, it means that the activity degree of the vulnerability is within an acceptable range, and the comprehensive risk level remains unchanged. After such adjustment, an adjusted comprehensive risk level is finally generated, which more accurately reflects the actual risk of the vulnerability to the power system.

[0127] Step S154: Extract the device state data unit with the earliest timestamp in the vulnerability associated cluster as the vulnerability starting data unit, and determine the starting time point of the vulnerability.

[0128] In the vulnerability-related cluster, the device state data units are sorted by timestamp, and the device state data unit with the earliest timestamp is found. This device state data unit represents the state of the device when the vulnerability first appeared, and is taken as the vulnerability starting data unit. The timestamp of this vulnerability starting data unit is the starting time point of the vulnerability, which can help power maintenance personnel understand when the vulnerability began to affect the power system, providing a time clue for subsequent troubleshooting and repair.

[0129] Step S155: Extract the device state data unit with the latest timestamp in the vulnerability-related cluster as the vulnerability current data unit, and determine the current time point of the vulnerability.

[0130] Similarly, the device state data unit with the latest timestamp in the vulnerability-related cluster is found and taken as the vulnerability current data unit. The timestamp of this vulnerability current data unit is the current time point of the vulnerability, which reflects the impact of the vulnerability on the power system at the current time. By comparing the starting time point and the current time point of the vulnerability, the development duration and trend of the vulnerability can be understood, which helps to assess the degree of harm of the vulnerability and develop appropriate maintenance strategies.

[0131] Step S156: Construct a warning information set according to the vulnerability location, vulnerability starting time point, vulnerability current time point, and comprehensive risk level, convert the warning information set into a structured data format supported by the power maintenance terminal, and generate a warning instruction containing vulnerability positioning information and risk level.

[0132] The vulnerability location, vulnerability starting time point, vulnerability current time point, and adjusted comprehensive risk level are combined to construct a warning information set. This warning information set contains key information about the vulnerability, allowing power maintenance personnel to fully understand the situation of the vulnerability. In order to enable the warning information to be correctly received and processed by the power maintenance terminal, the warning information set needs to be converted into a structured data format supported by the power maintenance terminal. For example, the information can be converted into a specific XML format or JSON format, which has a clear data structure and specification, facilitating the parsing and processing of the power maintenance terminal. The final generated warning instruction contains vulnerability positioning information and comprehensive risk level, which will be sent to the power maintenance terminal to trigger targeted maintenance operations.

[0133] Step S157: Send the warning instruction to the power maintenance terminal to trigger targeted maintenance operations.

[0134] The generated early warning instruction is sent to the power maintenance terminal through the data transmission network of the power system. After receiving the early warning instruction, the power maintenance terminal will automatically trigger the corresponding targeted maintenance operation according to the vulnerability positioning information and the comprehensive risk level contained in the instruction. For example, if the comprehensive risk level is high risk, the power maintenance terminal may immediately notify the maintenance personnel to go to the vulnerability location for emergency repair; if the comprehensive risk level is medium risk, maintenance may be arranged at a suitable time; if the comprehensive risk level is low risk, the monitoring of the vulnerability may be strengthened. At the same time, the power maintenance terminal also records the relevant information of the early warning instruction, including the vulnerability location, the starting time point, the current time point, the comprehensive risk level, etc., so as to carry out fault analysis and summarize experience in the future.

[0135] In the whole data collection and processing process, the equipment state data involved may contain some privacy sensitive information, such as specific operation parameters of equipment, power consumption information of users, etc. In order to protect these privacy sensitive data, a variety of privacy protection and anti-leakage technical means are adopted. In the data collection stage, the collected equipment state data is anonymized, and the information that can directly or indirectly identify the personal identity in the equipment state data is removed, such as user name, address, etc. In the data transmission process, encryption technology is used to encrypt the equipment state data, for example, using symmetric encryption algorithm to encrypt the data, only the power maintenance terminal with the corresponding decryption key can decrypt the data, to ensure that the equipment state data is not stolen or tampered in the transmission process. In terms of data storage, a secure storage system is used to control access to the stored data, only authorized personnel can access and process these data. At the same time, regular backup of data is carried out to prevent data loss due to unexpected circumstances. In addition, a security audit mechanism is established to record and audit the access and use of data, and timely discover and handle possible security vulnerabilities and abnormal behaviors.

[0136] Figure 2 A schematic diagram of exemplary hardware and software components of a system 100 for power system vulnerability identification based on data clustering that can implement the idea of the present application is shown. For example, a processor 120 can be used in the system 100 for power system vulnerability identification based on data clustering and for performing the functions in the present application.

[0137] The system 100 for power system vulnerability identification based on data clustering can be a general server or a special-purpose server, both of which can be used to implement the method of power system vulnerability identification based on data clustering of the present application. Although only one server is shown in the present application, for the sake of convenience, the functions described in the present application can be implemented in a distributed manner on multiple similar platforms to balance the processing load.

[0138] For example, the data clustering based power system vulnerability identification system 100 can include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and different forms of storage media 140, such as a disk, a ROM, or a RAM, or any combination thereof. Illustratively, the data clustering based power system vulnerability identification system 100 can also include program instructions stored in a ROM, a RAM, or other types of non-transitory storage media, or any combination thereof. The methods of the present application can be implemented according to these program instructions. The data clustering based power system vulnerability identification system 100 also includes an I / O interface 150 between the computer and other input / output devices.

[0139] For ease of illustration, only one processor is described in the data clustering based power system vulnerability identification system 100. However, it should be noted that the data clustering based power system vulnerability identification system 100 in the present application can also include multiple processors, and thus the steps performed by one processor described in the present application can also be performed jointly by multiple processors or individually. For example, if the processor of the data clustering based power system vulnerability identification system 100 performs steps A and B, it should be understood that steps A and B can also be performed jointly by two different processors or individually in one processor. For example, a first processor performs step A, a second processor performs step B, or the first processor and the second processor jointly perform steps A and B.

[0140] In addition, the present application also provides a readable storage medium, in which computer executable instructions are preset, and when a processor executes the computer executable instructions, the data clustering based power system vulnerability identification method as described above is implemented.

[0141] It should be noted that, in order to simplify the expression of the present application disclosure and thus help the understanding of one or more embodiments of the present application, in the foregoing description of the embodiments of the present application, various features are sometimes incorporated into one embodiment, figure or description thereof.

Claims

1. A method for power system vulnerability identification based on data clustering, characterized in that, The method comprises: obtaining a set of original monitoring data generated in the operation process of the power system, the set of original monitoring data comprising a plurality of device state data units marked with timestamps; performing format unification and noise suppression processing on the set of original monitoring data to obtain a set of preprocessed data; calling a pre-trained clustering analysis model to perform feature correlation clustering processing on the set of preprocessed data to generate a set of clustering results comprising vulnerability correlation clusters and normal operation clusters; based on the matching relationship between the feature distribution mode of the vulnerability correlation clusters in the set of clustering results and a preset vulnerability feature library, identifying the vulnerability location and the vulnerability development stage existing in the power system; generating an early warning instruction comprising vulnerability positioning information and a risk level according to the vulnerability location and the vulnerability development stage, and sending the early warning instruction to a power maintenance terminal to trigger a targeted maintenance operation.

2. The method of claim 1, wherein, The calling of the pre-trained clustering analysis model to perform feature correlation clustering processing on the set of preprocessed data to generate a set of clustering results comprising vulnerability correlation clusters and normal operation clusters comprises: inputting the set of preprocessed data into a time sequence feature extraction module of the clustering analysis model, extracting context correlation of time sequence features of device state data units by a bidirectional long short-term memory network to generate dynamic feature vectors with time sequence dependence; inputting the dynamic feature vectors into a spatial feature fusion module of the clustering analysis model, weighting and fusing spatial position correlation features of different device type data units by an attention mechanism to generate multi-dimensional fusion features containing time sequence correlation and spatial correlation; inputting the multi-dimensional fusion features into an adaptive clustering module of the clustering analysis model, automatically identifying concentrated areas and dispersed areas of data distribution in the feature space by a density peak clustering algorithm; defining the concentrated areas as normal operation clusters and the dispersed areas as vulnerability correlation clusters, the vulnerability correlation clusters comprising data units with feature distribution deviating from the normal operation mode; performing boundary optimization processing on the normal operation clusters and the vulnerability correlation clusters, adjusting the clustering center position by iteration to make the feature dispersion degree of data units in the vulnerability correlation clusters greater than a preset threshold, and generating a final set of clustering results.

3. The method of claim 2, wherein, The inputting of the set of preprocessed data into the time sequence feature extraction module of the clustering analysis model by the bidirectional long short-term memory network to extract context correlation of time sequence features of device state data units to generate dynamic feature vectors with time sequence dependence comprises: arranging the set of preprocessed data into a time sequence data sequence in timestamp order, the time sequence data sequence comprising a plurality of continuously collected device state data units; inputting the time sequence data sequence into a forward propagation layer of the bidirectional long short-term memory network, processing each device state data unit in turn from front to back to extract future context features of each device state data unit and subsequent device state data units; The time series data sequence is input into the back propagation layer of the bidirectional long short-term memory network, each device state data unit is processed in turn from back to front, and historical context features of each device state data unit and previous device state data units are extracted; The future context features output by the forward propagation layer and the historical context features output by the back propagation layer are subjected to an element-by-element addition operation by the state merging layer of the bidirectional long short-term memory network, and joint context features containing complete time context information are generated; The joint context features are subjected to dimension compression processing, and the high-dimensional features are mapped into a dynamic feature vector in a low-dimensional vector space through a fully connected layer, and the dynamic feature vector retains the time sequence variation law of the device state data unit.

4. The method of claim 2, wherein, The dynamic feature vector is input into the spatial feature fusion module of the clustering analysis model, and the spatial position correlation features of different device type data units are weighted and fused through an attention mechanism to generate multi-dimensional fusion features containing time sequence correlation and spatial correlation, including: Device spatial position information corresponding to each device state data unit in the dynamic feature vector is extracted, and the device spatial position information contains physical installation coordinates of the device in the power system; The spatial distance between different device type data units is calculated according to the device spatial position information, and a device-to-device spatial correlation matrix is constructed according to the spatial distance, and the element value in the device-to-device spatial correlation matrix represents the spatial proximity degree between devices; The dynamic feature vector and the device-to-device spatial correlation matrix are input into the attention mechanism module, and the attention weight of each device state data unit to the target data unit is calculated through the dot product operation of the query vector and the key vector; The dynamic feature vector is weighted and summed according to the attention weight to generate spatial context enhanced features of each device state data unit, and the spatial context enhanced features reflect the state influence of adjacent devices on the target device; The spatial context enhanced features and the original dynamic feature vector are spliced along the feature dimension to generate multi-dimensional fusion features containing time sequence correlation and spatial correlation.

5. The method of claim 2, wherein, The multi-dimensional fusion features are input into the adaptive clustering module of the clustering analysis model, and the centralized area and the dispersed area of data distribution in the feature space are automatically identified through the density peak clustering algorithm, including: The Euclidean distance between each data unit in the multi-dimensional fusion features and all other data units is calculated to generate a distance matrix in the feature space; The local density value of each data unit is calculated according to the distance matrix, and the local density value is the number of other data units with a distance less than the cutoff distance from the data unit; The relative distance value of each data unit is calculated, and the relative distance value is the minimum distance between the data unit and the data unit with a local density value greater than itself; Data units with local density values and relative distance values greater than a preset threshold are identified as cluster center candidate points; With the cluster center candidate points as the core, data units with a local density value less than the core point and closest to the core point are assigned to the corresponding cluster to generate an initial clustering result containing a centralized area and a dispersed area; The boundary point adjustment processing is performed on the initial clustering result, data units belonging to the boundaries of two clusters are re-assigned to the cluster with higher local density value, and a final centralized area and dispersed area division result is obtained.

6. The method of claim 2, wherein, The boundary optimization processing is performed on the normal operation cluster and the vulnerability associated cluster, the feature dispersion degree of the data units in the vulnerability associated cluster is greater than a preset threshold value by iteratively adjusting the position of the clustering center, and a final clustering result set is generated, including: An initial clustering center of the normal operation cluster is calculated, and the initial clustering center is a feature mean value of all data units in the normal operation cluster; An initial clustering center of the vulnerability associated cluster is calculated, and the initial clustering center is a feature mean value of all data units in the vulnerability associated cluster; An average distance between the data units in the vulnerability associated cluster and the initial clustering center of the vulnerability associated cluster is calculated as an initial dispersion degree; If the initial dispersion degree is less than a preset threshold value, the data unit farthest from the initial clustering center of the vulnerability associated cluster is re-assigned to the normal operation cluster, and the clustering center and the dispersion degree of the vulnerability associated cluster are recalculated; The re-assignment and recalculation operations are repeated until the dispersion degree of the vulnerability associated cluster is greater than or equal to the preset threshold value or the number of data units is less than a minimum cluster size, and the final adjusted normal operation cluster and vulnerability associated cluster are output as the final clustering result set.

7. The method of claim 1, wherein, Based on the matching relationship between the feature distribution pattern of the vulnerability associated cluster in the clustering result set and a preset vulnerability feature library, the position and development stage of the vulnerability existing in the power system are identified, including: A feature mean value, a feature variance and a feature change rate of all device state data units in the vulnerability associated cluster are extracted to construct a feature distribution pattern of the vulnerability associated cluster; Standard feature distribution patterns corresponding to different vulnerability types are obtained from the preset vulnerability feature library, and the standard feature distribution patterns include feature distribution parameters in the initial stage, the middle stage and the final stage of the vulnerability; Cosine similarity degrees between the feature distribution pattern of the vulnerability associated cluster and each standard feature distribution pattern are calculated, and the standard feature distribution pattern with the highest similarity degree is determined as a matching pattern; The position of the vulnerability existing in the power system is determined according to the vulnerability type corresponding to the matching pattern, and the position of the vulnerability is located through the device identification information associated with the matching pattern; The degree of coincidence between the feature distribution pattern of the vulnerability associated cluster and the feature distribution parameters in different development stages in the matching pattern is analyzed to identify the current development stage of the vulnerability, and the development stage of the vulnerability includes the initial stage, the middle stage and the final stage.

8. The method of claim 7, wherein, The degree of coincidence between the feature distribution pattern of the vulnerability associated cluster and the feature distribution parameters in different development stages in the matching pattern is analyzed to identify the current development stage of the vulnerability, including: Feature distribution parameter groups corresponding to the initial stage, the middle stage and the final stage of the vulnerability in the matching pattern are obtained, and the feature distribution parameter groups include a feature mean value fluctuation range, a feature variance stable interval and a feature change rate trend; Actual mean values, actual variances and actual rates in the feature distribution pattern of the vulnerability associated cluster are extracted as to-be-compared features; The features to be compared are respectively matched with the feature distribution parameter sets of each stage one by one, the number of times that the mean value falls within the corresponding fluctuation range, the number of times that the variance falls within the corresponding stable interval, and the number of times that the rate conforms to the corresponding trend are counted, and the initial matching item number, the medium-term matching item number, and the final matching item number are generated; The stage with the largest number of matching items is determined as the preliminary stage; The feature evolution sequence arranged according to the time stamp of the vulnerability correlation cluster is extracted, and the feature evolution sequence includes a mean value change curve, a variance change curve, and a rate change curve; The evolution reference curve corresponding to each stage in the matching mode is obtained, the shape similarity between the feature evolution sequence and each reference evolution curve is calculated, and the stage corresponding to the reference evolution curve with the highest similarity is selected as the verification stage; If the preliminary stage and the verification stage are consistent, the stage is output; if not, the stage with the largest sum of the matching item number and the similarity is selected as the final identification stage.

9. The method of claim 1, wherein, The pre-warning instruction containing the vulnerability positioning information and the risk level is generated according to the vulnerability position and the vulnerability development stage, including: Obtaining device type information corresponding to the vulnerability position and the functional importance level of the device in the power system, the functional importance level is divided according to the influence degree of the device on the stable operation of the system; Determining the risk basis level of the vulnerability according to the vulnerability development stage, the risk basis level increases from the initial stage to the final stage; Combining the functional importance level and the risk basis level to calculate the comprehensive risk level of the vulnerability, the comprehensive risk level is determined by weighted summation of the importance level and the basis level; Extracting the device state data unit with the earliest time stamp in the vulnerability correlation cluster as the vulnerability starting data unit, and determining the starting time point of the vulnerability; Extracting the device state data unit with the latest time stamp in the vulnerability correlation cluster as the vulnerability current data unit, and determining the current time point of the vulnerability; According to the vulnerability position, the vulnerability starting time point, the vulnerability current time point, and the comprehensive risk level, a pre-warning information set is constructed, the pre-warning information set is converted into a structured data format supported by the power maintenance terminal, and a pre-warning instruction containing vulnerability positioning information and risk level is generated.

10. A system for power system vulnerability identification based on data clustering, the system comprising: A device includes a processor and a memory, the memory and the processor are connected, the memory is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the memory to realize the method of identifying the vulnerability of the power system based on data clustering in any one of claims 1-9.

Images