Electric power system abnormal behavior analysis method based on safe operation baseline

Abstract

The invention discloses an electric power system abnormal behavior analysis method based on a safe operation baseline, and relates to the technical field of electric power abnormal analysis, and the method comprises the steps: collecting user label data and user power consumption behavior data; based on the user power consumption behavior data and the historical user power consumption behavior feature type data set, performing power consumption behavior feature type analysis processing corresponding to the user power consumption behavior; according to the power system abnormal behavior analysis method based on the safe operation baseline, feature clustering is carried out on overall power consumption behaviors of users, the clustered feature clusters serve as baselines of the corresponding users, and whether user tags corresponding to the power consumption behavior feature clusters corresponding to the power consumption behavior features of the users are the same as actual tags of the users or not is analyzed; according to the method, whether the power consumption behaviors of the users accord with the corresponding baselines or not is judged, the abnormality of the power consumption behaviors can be identified, the baselines of the users with similar power consumption behavior characteristics are aggregated into one baseline, and the number of the baselines and the burden during abnormality analysis are greatly reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power anomaly analysis, and in particular to a power system abnormal behavior analysis method based on a safe operation baseline. BACKGROUND

[0002] With the increasing complexity and intelligentization demand of modern power grids, the topology structure of the power grid is becoming increasingly complex, and the interaction demand with the user side is also increasing. However, with the injection of massive user behavior data into the system, the difficulty of abnormal behavior detection by the system is greatly increased. The prior art with publication number CN118432952A discloses an abnormality detection method in a zero-trust environment, an electronic device and a storage medium. The method comprises the following steps: in a power system in a zero-trust environment, acquiring terminal user log files and power grid entity identity data, constructing an access subject behavior characterization and association model according to the terminal user log files and the power grid entity identity data; acquiring subject access behavior data associated with the access subject, and constructing a self-behavior baseline of the access subject; acquiring group access behavior data of power grid entities with the same attribute, and constructing a group behavior baseline of entities with the same attribute; determining baseline evaluation information of the self-behavior baseline and the group behavior baseline based on a preset abnormality detection model, and determining an abnormality result. The prior art extracts behavior characteristics of the access subject from different dimensions, determines an abnormality result using a preset abnormality detection model, improves the accuracy of abnormality detection, and improves the safety of the power system.

[0003] However, the prior art constructs a self-behavior baseline and a group behavior baseline by extracting individual behavior characteristics and group behavior characteristics of the subject itself, which is suitable for abnormal analysis of the power consumption behavior of a single subject, but is not suitable for abnormal power consumption behavior analysis of a composite subject or group composed of multiple subjects. Moreover, with the development of society, the types of subjects are increasing, and the number of baselines to be established is also increasing, which greatly increases the burden of abnormal power consumption behavior analysis of the power grid. SUMMARY

[0004] The purpose of the present application is to provide a power system abnormal behavior analysis method based on a safe operation baseline to solve the above-mentioned deficiencies in the prior art.

[0005] In order to achieve the above-mentioned purpose, the present application provides the following technical solution: a power system abnormal behavior analysis method based on a safe operation baseline, comprising the following steps:

[0006] S1, collecting user tag data and user power consumption behavior data, wherein the user tag data comprises a plurality of user tags;

[0007] The initial data of the user label can be obtained in the form of investigation or questionnaire, and the user label is updated through subsequent analysis. The user label data can be a user type label, such as a resident user, a commercial user, an industrial user, a public utility user, an agricultural user, etc. The power consumption scale label, such as the power consumption capacity level, the monthly average power consumption, the maximum power consumption demand, etc. The power consumption behavior mode label, such as the power load curve form, including the peak-valley characteristics: flat type, lunch peak type, evening peak type, double peak type, etc. The volatility: standard deviation or mean value of load fluctuation frequency, load ratio extreme value, day / week / month load curve similarity, etc. The time dimension characteristic label, such as the peak period power consumption proportion, the difference between weekend and weekday power consumption, the difference between holiday and weekday power consumption, etc.

[0008] Further, a secondary label can be set under the primary label, such as setting a city resident user label and a rural resident user label under the resident user label, setting a shopping mall label, an office building label, a catering label, a shop label, a supermarket label, etc. under the commercial user label.

[0009] The power consumption information of the user can be collected by the electric meter and stored in the power system log. The user power consumption data with time stamp can be obtained through the power system log, wherein the power consumption data includes voltage, current, power, and energy. Further, a sliding window with a set time length can be set to follow the current time of the system on the time axis of the system log to obtain the user power consumption behavior data of the set time length.

[0010] S2, based on the user power consumption behavior data and the historical user power consumption behavior characteristic type data set, performing user power consumption behavior corresponding power consumption behavior characteristic type analysis processing to generate user power consumption behavior characteristic type analysis data;

[0011] S3, based on the user power consumption behavior characteristic type analysis data and the user power consumption behavior characteristic type-user label relationship data set, performing user power consumption behavior characteristic type corresponding user label matching and confidence analysis processing to generate user power consumption behavior characteristic type label and confidence analysis data;

[0012] S4, judging whether the user label corresponding to the user power consumption behavior characteristic type label and confidence analysis data matches the user label data, if yes, the user power consumption behavior is normal, if not, the user power consumption behavior is abnormal, the corresponding user power consumption behavior data is marked as abnormal, and the abnormal user power consumption behavior data is generated and sent to the user.

[0013] S5, collect the user's checking result of the abnormal user electricity behavior data, and judge whether the abnormal user electricity behavior data is a false alarm; in an embodiment, after receiving the abnormal user electricity behavior data, the user can judge whether the abnormal user electricity behavior data is a false alarm according to whether the electricity consumption and power in each period in the abnormal user electricity behavior data are consistent with the actual electricity consumption of the user, if consistent, it means false alarm, if not consistent, it means not false alarm.

[0014] S6, if it is a false alarm, mark the abnormal user electricity behavior data as normal, and update the user label data according to the user electricity behavior feature type label and the corresponding user label of the confidence analysis data.

[0015] Further, the S1 includes the following steps:

[0016] S1.1, collect user label data by investigation or questionnaire;

[0017] S1.2, set a sliding window with a set time length to slide on the time axis of the power system log, collect user electricity behavior data in the recent set time length, and generate user electricity behavior data.

[0018] Further, the S2 includes the following steps:

[0019] S2.1, collect historical user electricity behavior data according to the set frequency, and generate a historical user electricity behavior data set;

[0020] S2.2, respectively extract and standardize the user electricity behavior data and the historical user electricity behavior data set, and generate user electricity behavior feature data and a historical user electricity behavior feature data set;

[0021] S2.3, based on the DBSCAN clustering algorithm, cluster analysis is performed on the historical user electricity behavior feature data set to generate a historical user electricity behavior feature type data set composed of multiple historical user electricity behavior feature type data clusters;

[0022] S2.4, based on the core point coordinates of each historical user electricity behavior feature type data cluster in the historical user electricity behavior feature type data set and the parameters of the DBSCAN clustering algorithm, search the neighbors of the user electricity behavior feature data, return the historical user electricity behavior feature type data of the corresponding type of the core point in the field, output the historical user electricity behavior feature type data cluster of the type with the highest frequency, and generate user electricity behavior feature type analysis data.

[0023] Further, the S3 includes the following steps:

[0024] S3.1, label each type of historical user electricity consumption behavior feature type data using the set of user labels, and generate a user electricity consumption behavior feature type-user label relationship data set, wherein each type of historical user electricity consumption behavior feature type data has multiple user labels;

[0025] S3.2, based on the user electricity consumption behavior feature type-user label relationship data set, calculate the lower limit of the confidence interval at each confidence level for each user label combination corresponding to each user electricity consumption behavior feature type data, and generate a user electricity consumption behavior feature type-user label combination relationship confidence analysis data set, wherein the user label combination consists of at least one user label; in one embodiment, if a group of user label combinations correspond to multiple user electricity consumption behavior feature type data, calculate the lower limit of the confidence interval at each confidence level when the group of user label combinations correspond to the multiple user electricity consumption behavior feature type data as a whole; the confidence level can be 99%, 98%, 95%, 90%, etc.; if the confidence level and the lower limit of the confidence interval corresponding to a group of user label combinations and a type of user electricity consumption behavior feature type data are less than the set confidence level and the minimum confidence interval lower limit threshold, it is indicated that the group of user label combinations does not correspond to the type of user electricity consumption behavior feature type data.

[0026] S3.3, based on the breadth-first search, search for user label combinations that match the user electricity consumption behavior feature type analysis data in the user electricity consumption behavior feature type-user label combination relationship confidence analysis data set, and filter out user label combinations with confidence level and corresponding confidence interval lower limit greater than or equal to the set confidence level and confidence interval lower limit threshold, and generate user electricity consumption behavior feature type label and confidence analysis data; in one embodiment, the set confidence level and confidence interval lower limit threshold include multiple sets of data, and the confidence relationship between the user label combination and the user electricity consumption behavior feature type analysis data satisfies one of the sets of data, which is considered to be satisfied, for example, the user label combination and the user electricity consumption behavior feature type analysis data have 95% confidence level, and there is at least 95% confidence that they correspond, which is greater than the set confidence level and confidence interval lower limit threshold: "99% confidence level 90% confidence lower limit", "95% confidence level 92% confidence lower limit", "95% confidence level 92% confidence lower limit", so the user label combination is filtered out and generated into the user electricity consumption behavior feature type label and confidence analysis data.

[0027] Further, the S3.3 further comprises the following steps:

[0028] If the user electricity behavior feature type label and confidence analysis data contain multiple sets of user label combinations, the user label combinations are arranged in descending order according to the corresponding confidence level and lower limit of the confidence interval, that is, the user label combination with the highest confidence level and lower limit of the confidence interval is arranged at the front; the confidence level is compared preferentially, and if the confidence levels are the same, the lower limit of the confidence interval is compared.

[0029] Further, the S4 comprises the following steps:

[0030] S4.1, based on the naive algorithm, search whether there is the same user label combination as the user label data in the user electricity behavior feature type label and confidence analysis data;

[0031] S4.2, if yes, mark the user electricity behavior data as normal; if no, mark the user electricity behavior data as abnormal, and generate abnormal user electricity behavior data;

[0032] S4.3, perform the alarm notification work of the user according to the abnormal user electricity behavior data.

[0033] Further, the S6 comprises the following steps:

[0034] S6.1, if the abnormal user electricity behavior data is a false alarm, delete or modify the abnormal mark in the abnormal user electricity behavior data to a normal mark, so as to set it as user electricity behavior data;

[0035] S6.2, update the user electricity behavior data of the corresponding user based on the user label combination with the highest confidence level and lower limit of the confidence interval in the user electricity behavior feature type label and confidence analysis data corresponding to the user electricity behavior data. If the user label combination in the user electricity behavior feature type label and confidence analysis data is arranged in descending order according to the corresponding confidence level and lower limit of the confidence interval in the embodiment, the first user label combination of the user electricity behavior feature type label and confidence analysis data is selected to update the user label data.

[0036] 1. Compared with the prior art, the abnormal behavior analysis method of the power system based on the safe operation baseline provided by the application can not only identify the abnormality of the electricity behavior, but also achieve the aggregation of the baselines of the users with similar electricity behavior features into one baseline, greatly reducing the number of baselines and the burden of abnormal analysis.

[0037] 2. Compared with the prior art, the power system abnormal behavior analysis method based on safe operation baseline provided by the application realizes the adjustment of the user's power consumption behavior baseline according to the user's recent power consumption behavior characteristics, and guarantees the effect of the adaptation of the baseline to the user, by sending the abnormal user power consumption behavior data to the corresponding user for checking, and updating the user tag data using the user tag combination corresponding to the abnormal user power consumption behavior data after the user checks that the abnormal user power consumption behavior data is actually normal. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description only represent some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0039] Fig. 1 The method implementation step diagram provided by the embodiment of the present application is provided.

[0040] Fig. 2 The specific step diagram of the steps S1-S3 of the method provided by the embodiment of the present application is provided. DETAILED DESCRIPTION

[0041] In order to make those skilled in the art better understand the technical solutions of the present application, the present application will be further described in detail with reference to the drawings.

[0042] In the description of the present application, the terms "first", "second" are only used for description purpose, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited. In addition, the terms "mounting", "connecting", "connecting" should be understood broadly, for example, it can be fixed connection, or detachable connection, or integral connection; it can be mechanical connection, or electrical connection; it can be directly connected, or indirectly connected through intermediate medium, or the communication inside two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0043] In the following, the example embodiments will be described more fully with reference to the accompanying drawings, but the example embodiments can be embodied in different forms and should not be interpreted as being limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete, and to enable those skilled in the art to fully understand the scope of the present disclosure.

[0044] In the case of no conflict, the embodiments of the present disclosure and the features in the embodiments can be combined with each other.

[0045] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0046] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a" and "the" are also intended to include the plural forms unless the context clearly indicates otherwise. It will also be understood that when the terms "comprise" and / or "consist of" are used in the specification, the specified features, integers, steps, operations, elements, and / or components are present, but not excluding the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0047] Please refer to Figs. 1-2 A power system abnormal behavior analysis method based on a safe operation baseline, comprising the following steps:

[0048] S1, collecting user tag data and user power consumption behavior data, the user tag data including a plurality of user tags, comprising the following steps:

[0049] S1.1, collecting user tag data by investigation or questionnaire;

[0050] Wherein, the initial data of the user tag can be obtained by investigation or questionnaire, and the user tag can be updated through subsequent analysis; the user tag data can be user type tags, such as residential users, commercial users, industrial users, public utility users, and agricultural users; power consumption scale tags, such as power consumption capacity level, monthly average power consumption, maximum power consumption demand, etc.; power consumption behavior mode tags, such as power consumption load curve form, including peak-valley characteristics: flat type, noon peak type, evening peak type, double peak type, etc., volatility: standard deviation or mean of load fluctuation frequency, load ratio extreme value, day / week / month load curve similarity, etc.; time dimension characteristic tags, such as peak period power consumption proportion, weekend and weekday power consumption difference, holiday and weekday power consumption difference, etc.

[0051] Further, secondary tags can also be set under the primary tags, such as setting city resident user tags and rural resident user tags under the residential user tag; setting shopping mall tags, office building tags, restaurant tags, shop tags, supermarket tags, etc. under the commercial user tag.

[0052] S1.2, setting a sliding window with a set time length to slide on the time axis of the power system log, collecting the user power consumption behavior data of the recent set time length, and generating the user power consumption behavior data;

[0053] The user's power consumption information can be collected by an electric meter and stored in a power system log. The user's power consumption data with a timestamp can be obtained from the power system log, wherein the power consumption data includes voltage, current, power, and electric energy. Further, a sliding window with a set time length can be set to follow the current time of the system on the time axis of the system log, so as to obtain user's power consumption behavior data with a set time length, thereby only performing abnormal analysis and judgment on recent user's power consumption behavior data, and avoiding the influence of too much historical data on the analysis result. Further, a plurality of sliding windows with different set time lengths, such as one week, one month, one quarter, and half a year, can be set, so as to respectively perform abnormal analysis on the user's power consumption behavior in the past one week, one month, one quarter, and half a year.

[0054] S2, based on the user's power consumption behavior data and the historical user's power consumption behavior characteristic type data set, performing user's power consumption behavior corresponding power consumption behavior characteristic type analysis processing, generating user's power consumption behavior characteristic type analysis data, including the following steps:

[0055] S2.1, collecting historical user's power consumption behavior data at a set frequency to generate a historical user's power consumption behavior data set; wherein collecting historical user's power consumption behavior data at a set frequency includes collecting historical user's power consumption behavior data once every set time length or collecting historical user's power consumption behavior data once every set number of accumulations.

[0056] S2.2, performing feature extraction and standardization processing on the user's power consumption behavior data and the historical user's power consumption behavior data set respectively, to generate user's power consumption behavior feature data and historical user's power consumption behavior feature data set;

[0057] S2.3, based on the DBSCAN clustering algorithm, performing clustering analysis on the historical user's power consumption behavior feature data set to generate a historical user's power consumption behavior characteristic type data set composed of a plurality of historical user's power consumption behavior characteristic type data clusters;

[0058] S2.4, based on the core point coordinates of each type of historical user's power consumption behavior characteristic type data cluster in the historical user's power consumption behavior characteristic type data set, and the parameters of the DBSCAN clustering algorithm, searching for the neighbors of the user's power consumption behavior feature data, returning the historical user's power consumption behavior characteristic type data of the type corresponding to the core point in the field, outputting the historical user's power consumption behavior characteristic type data cluster of the type with the highest frequency of occurrence, and generating user's power consumption behavior characteristic type analysis data.

[0059] Specifically: using the historical user power consumption behavior feature data set to train the DBSCAN clustering algorithm to obtain algorithm parameters: domain radius and core point minimum neighbor number; collecting the index of each data corresponding historical user power consumption behavior feature data cluster and all core points in the historical user power consumption behavior feature data set; constructing a spatial index of the core points based on the KD-Tree or Ball-Tree to speed up the domain search; searching for the neighbors of the user power consumption behavior feature data in the core points with the domain radius of the algorithm as the search radius; if the returned core points are empty, it means that the user power consumption behavior feature data is different from the features of any historical user power consumption behavior feature cluster, if the returned core points are not empty, then the number of each historical user power consumption behavior feature cluster corresponding to the core points in the domain is counted, and the historical user power consumption behavior feature cluster with the highest number is selected as the user power consumption behavior feature type analysis data.

[0060] S3, based on the user power consumption behavior feature type analysis data and the user power consumption behavior feature type-user label relationship data set, performing user power consumption behavior feature type corresponding user label matching and confidence analysis processing to generate user power consumption behavior feature type label and confidence analysis data, including the following steps:

[0061] S3.1, using the set user label to mark each type of historical user power consumption behavior feature type data to generate a user power consumption behavior feature type-user label relationship data set, wherein each type of historical user power consumption behavior feature type data has multiple user labels;

[0062] S3.2, based on the user power consumption behavior feature type-user label relationship data set, the corresponding relationship between each user label combination and each user power consumption behavior feature type data exists, the lower limit of the confidence interval under each confidence level is calculated and processed to generate a user power consumption behavior feature type and user label combination relationship confidence analysis data set, wherein the user label combination is composed of at least one user label; in one embodiment, if a group of user label combinations correspond to multiple user power consumption behavior feature type data at the same time, the lower limit of the confidence interval under each confidence level is calculated when the whole of the several user power consumption behavior feature type data corresponds to the user label combination; the confidence level can be 99%, 98%, 95%, 90%, etc.; if the confidence level and the lower limit of the confidence interval corresponding to a group of user label combinations and a type of user power consumption behavior feature type data are less than the set confidence level and the lowest confidence interval lower limit threshold, it means that the group of user label combinations and the type of user power consumption behavior feature type data do not have a corresponding relationship.

[0063] S3.3, based on the breadth-first search, search the user label combination matching the user electricity consumption behavior characteristic type analysis data in the user electricity consumption behavior characteristic type and user label combination relationship confidence analysis data set, and filter out the user label combination whose confidence level and corresponding confidence interval lower limit is greater than or equal to the set confidence level and confidence interval lower limit threshold, generate the user electricity consumption behavior characteristic type label and confidence analysis data; in an embodiment, the set confidence level and confidence interval lower limit threshold includes multiple sets of data, and the confidence relationship corresponding to the user label combination and the user electricity consumption behavior characteristic type analysis data satisfies one set of data, which is regarded as meeting the requirement, for example, the user label combination and the user electricity consumption behavior characteristic type analysis data are at 95% confidence level, and it is believed that the corresponding is at least 95%, which is greater than the set confidence level and confidence interval lower limit threshold: "99% confidence level 90% confidence lower limit", "95% confidence level 92% confidence lower limit", and "95% confidence level 92% confidence lower limit" in "95% confidence level 92% confidence lower limit", the user label combination is filtered out and generated into the user electricity consumption behavior characteristic type label and confidence analysis data.

[0064] Further, if the user electricity consumption behavior characteristic type label and confidence analysis data contain multiple user label combinations, the user label combinations are arranged in descending order according to the corresponding confidence level and confidence interval lower limit, that is, the user label combination with the highest confidence level and confidence interval lower limit is arranged at the front; the confidence level is compared preferentially, and if the confidence levels are the same, the confidence interval lower limit is compared.

[0065] Through the S2 and S3 steps, the historical user electricity consumption behavior characteristic data cluster can be used as the user electricity consumption behavior baseline of the corresponding user label data.

[0066] S4, judge whether the user label corresponding to the user electricity consumption behavior characteristic type label and confidence analysis data matches the user label data, if yes, the user electricity consumption behavior is normal, if not, the user electricity consumption behavior is abnormal, mark the corresponding user electricity consumption behavior data as abnormal, generate abnormal user electricity consumption behavior data and send it to the user, including the following steps:

[0067] S4.1, based on the naive algorithm, search whether there is a user label combination same as the user label data in the user electricity consumption behavior characteristic type label and confidence analysis data;

[0068] S4.2, if yes, mark the user electricity consumption behavior data as normal; if not, mark the user electricity consumption behavior data as abnormal, generate abnormal user electricity consumption behavior data;

[0069] S4.3, execute the alarm notification work for the user according to the abnormal user electricity consumption behavior data.

[0070] The S4 step can take the historical user power consumption behavior feature data cluster as the user power consumption behavior baseline, and whether the user power consumption behavior feature matching user label combination is the same as the corresponding user label data is analyzed to determine whether the user power consumption behavior conforms to the user behavior baseline, so as to achieve the effect of abnormal user power consumption behavior recognition.

[0071] S5, collecting the user's checking result of the abnormal user power consumption behavior data, judging whether the abnormal user power consumption behavior data is a false alarm; in an embodiment, after the user receives the abnormal user power consumption behavior data, the user can judge whether the abnormal user power consumption behavior data is a false alarm according to whether the power consumption and power consumption of each period in the abnormal user power consumption behavior data are consistent with the actual power consumption of the user, if they are consistent, it means false alarm, if they are not consistent, it means not false alarm.

[0072] S6, if it is a false alarm, the abnormal user power consumption behavior data is marked as normal, and the user label data is updated according to the user power consumption behavior feature type label and the corresponding user label of the confidence analysis data, including the following steps:

[0073] S6.1, if the abnormal user power consumption behavior data is a false alarm, the abnormal mark in the abnormal user power consumption behavior data is deleted or modified as a normal mark, so as to set it as user power consumption behavior data, the normal user power consumption behavior data will be added to the historical user power consumption behavior data, and after meeting the setting frequency, it will be updated to the historical user power consumption behavior data set together;

[0074] S6.2, updating the user power consumption behavior data of the corresponding user based on the user power consumption behavior feature type label and the user label combination with the highest confidence level and confidence interval lower limit in the confidence analysis data. If in the embodiment, the user label combination in the user power consumption behavior feature type label and the confidence analysis data is arranged in descending order according to the corresponding confidence level and confidence interval lower limit, the first user label combination of the user power consumption behavior feature type label and the confidence analysis data is selected to update the user label data.

[0075] In an embodiment, if the abnormal user power consumption behavior data is not a false alarm, the abnormal user power consumption behavior data can be deleted or recorded and stored according to actual needs.

[0076] The above only describes some exemplary embodiments of the application by way of illustration, and it is needless to say that those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the application. Therefore, the above figures and description are illustrative in nature and should not be understood as limiting the scope of protection of the claims of the application.

Claims

1. A method for power system abnormal behavior analysis based on a security operation baseline, characterized in that: The method comprises the following steps: S1, collecting user label data and user electricity consumption behavior data, wherein the user label data comprises a plurality of user labels; S2, based on the user electricity consumption behavior data and the historical user electricity consumption behavior characteristic type data set, performing user electricity consumption behavior corresponding electricity consumption behavior characteristic type analysis processing to generate user electricity consumption behavior characteristic type analysis data; S3, based on the user electricity consumption behavior characteristic type analysis data and the user electricity consumption behavior characteristic type-user label relationship data set, performing user electricity consumption behavior characteristic type corresponding user label matching and confidence analysis processing to generate user electricity consumption behavior characteristic type label and confidence analysis data; S4, judging whether the user electricity consumption behavior characteristic type label and confidence analysis data corresponding user label matches the user label data, if yes, the user electricity consumption behavior is normal, if not, the user electricity consumption behavior is abnormal, the corresponding user electricity consumption behavior data is marked as abnormal, and the abnormal user electricity consumption behavior data is generated and sent to the user.

2. The abnormal behavior analysis method of the power system based on the safe operation baseline according to claim 1, characterized in that: S5, collecting the checking result of the user on the abnormal user electricity consumption behavior data, judging whether the abnormal user electricity consumption behavior data is a false alarm; S6, if yes, marking the abnormal user electricity consumption behavior data as normal, and updating the user label data according to the user label corresponding to the user electricity consumption behavior characteristic type label and confidence analysis data.

3. The method of claim 1, wherein: The S1 comprises the following steps: S1.1, collecting user label data through investigation or questionnaire; S1.2, setting a sliding window with a set time length to slide on the time axis of the power system log, collecting user electricity consumption behavior data in the recent set time length, and generating user electricity consumption behavior data.

4. The method of claim 1, wherein: The S2 comprises the following steps: S2.1, collecting historical user electricity consumption behavior data at a set frequency to generate a historical user electricity consumption behavior data set; S2.2, performing feature extraction and standardization processing on the user electricity consumption behavior data and the historical user electricity consumption behavior data set respectively to generate user electricity consumption behavior feature data and a historical user electricity consumption behavior feature data set; S2.3, based on the DBSCAN clustering algorithm, performing clustering analysis on the historical user electricity consumption behavior feature data set to generate a historical user electricity consumption behavior characteristic type data set composed of a plurality of historical user electricity consumption behavior characteristic type data clusters; S2.4, based on the core point coordinates of each historical user electricity consumption behavior characteristic type data cluster in the historical user electricity consumption behavior characteristic type data set and the parameters of the DBSCAN clustering algorithm, searching for neighbors of the user electricity consumption behavior feature data, returning historical user electricity consumption behavior characteristic type data of the corresponding type of the core point in the field, outputting the historical user electricity consumption behavior characteristic type data cluster of the highest frequency type, and generating user electricity consumption behavior characteristic type analysis data.

5. The method for power system abnormal behavior analysis based on security operation baseline according to claim 1, characterized in that: The S3 comprises the following steps: S3.1, label each type of historical user electricity consumption behavior feature type data using the set user label, generate user electricity consumption behavior feature type-user label relationship data set; S3.2, based on the user electricity consumption behavior feature type-user label relationship data set, each user label combination and each user electricity consumption behavior feature type data exists corresponding relationship, the lower limit of the confidence interval under each confidence level calculation processing, generate user electricity consumption behavior feature type and user label combination relationship confidence analysis data set; S3.3, based on the breadth first search, search the user label combination matching the user electricity consumption behavior feature type analysis data in the user electricity consumption behavior feature type and user label combination relationship confidence analysis data set, and filter out the user label combination whose confidence level and corresponding confidence interval lower limit is greater than or equal to the set confidence level and confidence interval lower limit threshold, generate user electricity consumption behavior feature type label and confidence analysis data.

6. The method for power system abnormal behavior analysis based on security operation baseline according to claim 5, characterized in that: The S3.3 further comprises the following steps: If the user electricity consumption behavior feature type label and confidence analysis data contain multiple user label combinations, arrange the user label combinations in descending order according to the corresponding confidence level and confidence interval lower limit.

7. The method of claim 1, wherein: The S4 comprises the following steps: S4.1, based on the naive algorithm, search whether there is the same user label combination in the user electricity consumption behavior feature type label and confidence analysis data as the user label data; S4.2, if yes, mark the user electricity consumption behavior data as normal; if no, mark the user electricity consumption behavior data as abnormal, generate abnormal user electricity consumption behavior data; S4.3, execute the alarm notification work of the user according to the abnormal user electricity consumption behavior data.

8. The method of claim 2, wherein: The S6 comprises the following steps: S6.1, if the abnormal user electricity consumption behavior data is false alarm, set the abnormal user electricity consumption behavior data as user electricity consumption behavior data; S6.2, based on the user label combination with the highest confidence level and confidence interval lower limit in the user electricity consumption behavior feature type label and confidence analysis data corresponding to the user electricity consumption behavior data, update the user electricity consumption behavior data of the corresponding user.

Images