A power stealing detection method and system based on smart meter data

Abstract

The application provides a power stealing detection method and system based on smart meter data, and relates to the technical field of power stealing detection. The method comprises the following steps: acquiring observation meter data of each transformer side and power consumption data of multiple users in a detection area, and determining a suspected power stealing area through comparative analysis; determining a ratio profile sequence of each user and extracting frequency domain features according to each observation meter data and corresponding power consumption data in the suspected power stealing area; grouping each user through a clustering algorithm based on the frequency domain features to obtain multiple different power consumption mode groups; calculating the membership degrees of each user to each power consumption mode group, and calculating the abnormal scores of each user according to the membership degrees; if the abnormal score is greater than a preset abnormal score, the user is determined as a suspected power stealing user, and a power stealing detection model based on a random forest is used to determine a power stealing user according to the frequency domain features of the suspected power stealing user; otherwise, the user is determined as a normal user.

Description

Technical Field

[0001] This invention relates to the field of electricity theft detection technology, and in particular to an electricity theft detection method and system based on smart meter data. Background Technology

[0002] With the rapid development of smart grids and IoT technologies, smart meters, as crucial terminal devices in power systems, have been widely applied in residential, commercial, and industrial electricity consumption scenarios. Smart meters enable real-time data collection, remote meter reading, and two-way communication, providing power companies with accurate user load information and energy consumption characteristics. However, despite the widespread deployment of smart meters, electricity theft remains rampant, causing economic losses to power companies and threatening the safety and stability of the power grid. Therefore, how to automatically identify abnormal electricity consumption and detect electricity theft based on the big data collected by smart meters has become an important research direction in the field of power information technology.

[0003] With the development of smart meters and big data technology, data-driven intelligent analysis methods have gradually become a research hotspot. These methods utilize machine learning or deep learning algorithms to extract features and perform modeling analysis on time-series electricity consumption data collected by smart meters. By using classification or clustering models to identify abnormal users, they can achieve automatic detection of electricity theft. Compared to traditional rule-based methods, these methods are more adaptive and accurate, capable of mining potential nonlinear features from large amounts of data, providing power companies with more efficient risk identification tools.

[0004] However, existing technologies typically judge suspicious users from a single dimension, failing to fully consider the correlation between the transformer side and the user side, resulting in low positioning accuracy of suspicious areas. Furthermore, existing detection results largely rely on static thresholds or fixed classification models, lacking quantitative analysis of the relationships between different users and abnormal groups, and failing to achieve adaptive adjustment of detection strategies at the clustering level, thus limiting the accuracy and reliability of anomaly detection. Summary of the Invention

[0005] To address the shortcomings of existing technologies that typically judge suspicious users from a single dimension, failing to fully consider the correlation between the transformer side and the user side, resulting in low accuracy in locating suspicious areas, and the fact that existing detection results often rely on static thresholds or fixed classification models, lacking quantitative analysis of the relationship between different users and abnormal groups, and unable to achieve adaptive adjustment of detection strategies at the clustering level, thus limiting the accuracy and reliability of anomaly detection, this invention provides a method and system for detecting electricity theft based on smart meter data.

[0006] The technical solutions provided by the embodiments of the present invention are as follows:

[0007] First aspect:

[0008] This invention provides a method for detecting electricity theft based on smart meter data, comprising:

[0009] S1: Acquire observation table data from each transformer side in the detection area and electricity consumption data from multiple users;

[0010] S2: Based on the data from each observation table and the electricity consumption data, suspected areas of electricity theft are identified through comparative analysis.

[0011] S3: Determine the ratio profile sequence of each user based on the observation table data and the corresponding electricity consumption data in the suspected electricity theft area;

[0012] S4: Extract the frequency domain features of each of the ratio profile sequences;

[0013] S5: Based on the frequency domain characteristics, the users are grouped using a clustering algorithm to obtain multiple different electricity consumption pattern groups;

[0014] S6: Calculate the membership degree of each user to each of the electricity consumption mode groups, and calculate the anomaly score of each user based on each membership degree;

[0015] S7: Determine whether the abnormal score of each user is greater than the preset abnormal score; if so, determine the user as a suspected electricity theft user and proceed to S8; otherwise, determine the user as a normal user.

[0016] S8: Based on the frequency domain characteristics of the suspected electricity theft users, the electricity theft users are identified using a random forest-based electricity theft detection model.

[0017] The second aspect:

[0018] This invention provides an electricity theft detection system based on smart meter data, comprising:

[0019] processor;

[0020] A memory storing computer-readable instructions, which, when executed by the processor, implement the electricity theft detection method based on smart meter data as described in the first aspect.

[0021] Third aspect:

[0022] The present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the electricity theft detection method based on smart meter data as described in the first aspect.

[0023] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0024] In this invention, by jointly analyzing observation data from the transformer side and electricity consumption data from the user side, an energy transmission correlation between the power supply end and the power consumption end is established, thereby enhancing the ability to locate areas with abnormal electricity consumption. Through cluster analysis of user frequency domain characteristics, multiple electricity consumption pattern groups are constructed, and the degree of user affiliation in each group is quantified based on a membership function, thus establishing a correlation model between individual users and different electricity consumption behavior groups. Furthermore, by combining an adaptive anomaly scoring mechanism and an additive tree model, the final intelligent judgment is achieved, effectively breaking through the dependence on static thresholds or fixed classification models, and significantly improving the accuracy and reliability of the detection results. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart illustrating a method for detecting electricity theft based on smart meter data, provided in an embodiment of the present invention.

[0027] Figure 2 This is a schematic diagram of a power theft detection system based on smart meter data, provided as an embodiment of the present invention. Detailed Implementation

[0028] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0029] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0030] In this embodiment of the invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the difference, they convey the same meaning. Similarly, the terms "corresponding" and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the difference, they convey the same meaning.

[0031] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0032] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0033] Reference manual attached Figure 1 The diagram shows a flowchart of a method for detecting electricity theft based on smart meter data provided by an embodiment of the present invention.

[0034] This invention provides a method for detecting electricity theft based on smart meter data. This method can be implemented by a smart meter data-based electricity theft detection device, which can be a terminal or a server. The processing flow of the smart meter data-based electricity theft detection method may include the following steps:

[0035] S1: Acquire observation table data from each transformer side in the detection area and electricity consumption data from multiple users.

[0036] In one possible implementation, S1 specifically includes:

[0037] S101: Deploy observation meters on each transformer side in the detection area to obtain data from multiple observation meters.

[0038] An observation meter is a high-precision metering device installed on the outgoing side of a distribution transformer to monitor the total power supply of the entire power supply area or distribution zone in real time. Unlike ordinary user meters, observation meters do not measure the power of individual users, but rather aggregate and measure the total energy output of all users under a particular transformer.

[0039] S102: Obtain electricity consumption data from multiple users on each transformer side through smart meters installed by users.

[0040] Among them, a smart meter is a user-end electricity metering device with automatic metering, remote communication, and data management functions. Unlike traditional mechanical meters, smart meters can automatically collect information such as electricity consumption, voltage, and current from users at fixed time intervals (such as every 15 minutes or every hour), and upload it to a data concentrator or master station system via wireless or wired communication.

[0041] Specifically, an observer meter is installed on the transformer outgoing side of each monitoring area. This meter records the total power supply data for that area in real time over a certain time interval (e.g., every 15 minutes or 1 hour). The observer meter data includes timestamps, energy readings, and line numbers, reflecting the overall power load of the area. Simultaneously, a smart meter is installed or connected to each user's terminal within the transformer's power supply range. The smart meter automatically collects and uploads the user's actual power consumption data within the same time interval. This results in the observer meter data for each transformer side and the power consumption data for multiple users.

[0042] S2: Based on the data from each observation table and each electricity consumption data, suspected areas of electricity theft are identified through comparative analysis.

[0043] It should be noted that the comparative analysis method is an anomaly detection method based on the principle of energy conservation, and is commonly used in power distribution network theft identification and energy consumption analysis. This method compares the electricity metering data at different levels within the same power supply area to determine whether there are abnormal losses or metering deviations.

[0044] In one possible implementation, S2 specifically includes:

[0045] S201: Sum the electricity consumption data of each user corresponding to each transformer side to obtain the total electricity consumption data of multiple users.

[0046] S202: Based on the observation table data from each transformer side and the corresponding total user electricity consumption data, calculate the electricity consumption error value:

[0047]

[0048] in, This represents the electricity consumption error value in the t-th time period. This represents the observation data for the t-th time period, where n represents the total number of users. This represents the electricity consumption of the i-th user in the t-th time period. This represents the total electricity consumption data for the user.

[0049] S203: Calculate the dynamic power consumption error threshold for each transformer side:

[0050]

[0051] in, Indicates the dynamic electricity consumption error threshold. This represents the average historical power consumption error value on the same transformer side. Represents dynamic coefficients. This represents the standard deviation of historical power consumption error values ​​on the same transformer side.

[0052] S204: Determine whether each power consumption error value is less than the corresponding dynamic power consumption error threshold. If yes, return to S1 and wait for the next round of detection. Otherwise, mark the power supply area corresponding to the transformer side as a suspected power theft area.

[0053] In this embodiment of the invention, by performing energy difference calculations on the data from the transformer-side observation meter and the data from each user's smart meter, the power supply and consumption balance of the distribution substation can be accurately reflected, thereby enabling real-time identification of abnormal losses. Simultaneously, the introduced dynamic threshold is adaptively adjusted based on the mean and standard deviation of historical errors, automatically adapting to differences in operating environments such as seasonal changes and load fluctuations, reducing false alarms and missed alarms, and accurately identifying suspected electricity theft areas.

[0054] S3: Based on the observation table data and corresponding electricity consumption data in the suspected electricity theft area, determine the ratio profile sequence of each user.

[0055] It should be noted that the ratio profile sequence is a feature sequence used to characterize the relative electricity consumption behavior of users. By eliminating the impact of overall load fluctuations on individual electricity consumption data, it can more accurately reflect the electricity consumption characteristics of users themselves.

[0056] In one possible implementation, S3 specifically includes:

[0057] S301: Calculate the ratio profile value based on the observation table data and various electricity consumption data in the suspected electricity theft area:

[0058]

[0059] in, This represents the ratio profile value, which is the proportion of the electricity consumption of the i-th user in the t-th time period to the total electricity consumption of the entire suspected electricity theft area in the t-th time period. This represents the electricity consumption of the i-th user in the suspected electricity theft area during the t-th time period. This represents the observation data of the transformer side in the suspected electricity theft area during the t-th time period.

[0060] S302: Extract the ratio profile sequence for each user based on the ratio profile values:

[0061]

[0062] in, This represents the ratio profile sequence of the i-th user. Let t represent the proportion of the electricity consumption of the i-th user in the t-th time period to the total electricity consumption of the entire suspected electricity theft area in the t-th time period, where t = 1, 2, ..., T, and T represents the total number of time periods.

[0063] In this embodiment of the invention, transformer-side observation data is used as a reference benchmark for the total regional power supply. The normalized ratio of each user's electricity consumption during the same time period to this total is calculated, forming a time-series ratio profile. This feature not only offsets overall load fluctuations caused by seasonal, climatic, or electricity demand changes, but also highlights abnormal changes in the relative proportions of individual users, thereby enhancing the stability and comparability of subsequent feature extraction and cluster analysis. Through the construction of the ratio profile sequence, the system can achieve cross-time period and cross-regional comparison of electricity consumption behavior, providing more robust and standardized input data for subsequent frequency domain feature extraction and electricity theft pattern identification.

[0064] S4: Extract the frequency domain features of each ratio profile sequence.

[0065] In one possible implementation, S4 specifically includes:

[0066] S401: Using the db1 wavelet basis, perform 4-level discrete wavelet transform decomposition on the ratio profile sequences of each user.

[0067] Among them, the db1 wavelet basis (Daubechies1 wavelet basis) is a commonly used discrete wavelet transform basis function, proposed by Ingrid Daubechies, and belongs to the simplest form in the wavelet family.

[0068] It should be noted that the db1 wavelet basis can effectively extract low-frequency trends and high-frequency abrupt changes in time series signals. It is suitable for time series analysis of electricity consumption data, which has obvious periodicity and local fluctuation characteristics. Therefore, it is often used in frequency domain feature extraction and anomaly detection of user electricity consumption behavior.

[0069] S402: In each decomposition layer, low-pass and high-pass filters are used to convolve and downsample the approximation coefficients of the previous layer to obtain the low-frequency and high-frequency components of each layer:

[0070]

[0071] in, Let v represent the low-frequency components of the p-th layer, v represent the coefficient index after downsampling, and w represent the discrete-time index. This represents the coefficients of the low-pass filter. This represents the low-frequency components of the (p-1)th layer. This represents the high-frequency components of the p-layer. This represents the coefficients of the high-pass filter.

[0072] S403: Extract the fourth-level low-frequency components of each ratio profile sequence and normalize each fourth-level low-frequency component to obtain the frequency domain features of each ratio profile sequence.

[0073] Specifically, in this stage, the frequency domain features of the user ratio profile sequence are extracted using Discrete Wavelet Transform (DWT). First, the db1 wavelet basis is selected to perform a four-level decomposition on the ratio profile sequence for each user, sequentially separating low-frequency and high-frequency components at different scales. During the decomposition process, the system uses low-pass and high-pass filters to convolve and downsample the signal, obtaining approximation coefficients and detail coefficients for each level. Finally, the fourth-level approximation coefficients (low-frequency components) are extracted and normalized to form the user's frequency domain feature vector. This feature can preserve the user's long-term stable electricity consumption patterns while filtering out short-term fluctuations, providing stable and reliable input data for subsequent clustering and anomaly detection.

[0074] It should be noted that the fourth-level low-frequency component was chosen as the frequency domain feature of the ratio profile sequence primarily to achieve a balance between resolution and smoothness. Each level of discrete wavelet transform reduces the signal's temporal resolution by half and increases its frequency resolution by half. The higher the decomposition level, the smoother the low-frequency component and the longer the time scale it represents. If the decomposition level is too low (e.g., 1-2 levels), the signal still contains a lot of short-term fluctuations and noise, which is not conducive to reflecting users' long-term electricity consumption patterns. On the other hand, if the decomposition level is too high, it may lead to over-smoothing of features and loss of detailed information. Experiments have verified that when analyzing daily or hourly electricity consumption sequences, the four-level decomposition can better preserve users' long-term electricity consumption trends while effectively suppressing high-frequency interference such as abnormal spikes and short-term abrupt changes. Therefore, the fourth-level low-frequency component was selected as the final frequency domain feature vector, which can reflect typical electricity consumption patterns while maintaining high feature discriminative power.

[0075] In this embodiment of the invention, a four-level discrete wavelet decomposition is performed on the ratio profile sequence using the db1 wavelet basis, and the low-frequency components of the fourth level are extracted as frequency domain features. This effectively separates the long-term trend and short-term fluctuations in user electricity consumption data, thereby improving the stability and anti-interference capability of the features. Simultaneously, the multi-level decomposition structure can decompose the user's ratio profile sequence into frequency components of different scales. The high-frequency component reflects short-term fluctuations or abrupt changes, while the low-frequency component reflects long-term electricity consumption patterns. By extracting the low-frequency components of the fourth level and performing normalization, the long-term electricity consumption pattern characteristics of users can be effectively preserved, eliminating the influence of abnormal fluctuations, metering errors, or random noise on the detection results.

[0076] S5: Based on frequency domain features, users are grouped using a clustering algorithm to obtain multiple different electricity consumption pattern groups.

[0077] Clustering algorithms are unsupervised learning methods that automatically divide data into several groups (i.e., clusters) based on the similarity or distance between samples, so that data within the same cluster have high similarity, while different clusters have large differences.

[0078] Optionally, the clustering algorithm uses the fuzzy C-means algorithm.

[0079] In one possible implementation, S5 specifically includes:

[0080] S501: Initialize clustering parameters, which include the number of clusters, fuzzy index, membership degree change threshold, and maximum number of iterations.

[0081] S502: Constructing the clustering objective function:

[0082]

[0083]

[0084] Where J represents the clustering objective function value, n represents the total number of users, and c represents the number of clusters. This represents the weighted contribution of the i-th user when updating the cluster, and ε=2 represents the fuzzy index. Represents the square of the Euclidean distance. This represents the frequency domain feature vector of the i-th user. Let represent the center vector of the j-th cluster.

[0085] S503: Iteratively update the membership degree and cluster centers of each user with the goal of minimizing the clustering objective function.

[0086]

[0087] in, Let represent the membership degree of the i-th user to the j-th cluster, and k represent the clustering index. This represents the k-th cluster.

[0088] S504: If the maximum change in membership degree among all users is less than the membership degree change threshold or the current iteration number reaches the maximum iteration number, stop the iteration and complete the clustering of the electricity consumption pattern group.

[0089] S505: Calculate the profile coefficient for each user and, based on the profile coefficients, calculate the average profile coefficient.

[0090] S506: Determine if the average profile coefficient is greater than the preset profile coefficient. If yes, determine that the clustering result is valid and proceed to S507. Otherwise, return to S501 and re-cluster.

[0091] It should be noted that those skilled in the art can set the size of the preset contour coefficient according to actual needs, and this invention does not limit this.

[0092] S507: Define the updated cluster centers as different electricity consumption pattern groups.

[0093] S508: Using the principle of maximum membership, each user is assigned to the corresponding electricity consumption mode group.

[0094] Specifically, in this stage, cluster analysis of users' frequency domain features enables automatic identification of different electricity consumption patterns. The system first initializes parameters such as the number of clusters, fuzzy index, membership degree change threshold, and maximum number of iterations based on the extracted user frequency domain feature vectors. Then, a fuzzy C-means algorithm is used for clustering, iteratively updating user membership degrees and cluster centers by minimizing the objective function until the results converge. After clustering, the system calculates the silhouette coefficient to evaluate the clustering quality. If the result is valid, the cluster centers are defined as typical electricity consumption pattern groups, and users are assigned to the corresponding groups based on the maximum membership degree principle. This process groups users with similar electricity consumption characteristics into one category, providing fundamental data support for subsequent anomaly score calculation and electricity theft user identification.

[0095] In this embodiment of the invention, the Fuzzy C-means (FCM) algorithm is used to divide users into multiple different electricity consumption pattern groups based on the similarity between users' frequency domain features. Unlike traditional hard clustering, FCM allows users to belong to multiple clusters simultaneously and reflects the fuzziness of their electricity consumption features through membership values, which better reflects the complexity of actual electricity user behavior. Simultaneously, by iteratively optimizing the objective function, user features within the same group become more similar, and differences between different groups become more pronounced, thereby improving the discriminative power of the grouping results.

[0096] Furthermore, by verifying the clustering quality through the silhouette coefficient, the rationality of the clustering can be automatically determined, ensuring the stability and credibility of the final results.

[0097] S6: Calculate the membership degree of each user to each electricity consumption mode group, and calculate the anomaly score of each user based on each membership degree.

[0098] Among them, the membership degree of the electricity consumption mode group represents the degree of similarity of users in different electricity consumption modes, which is a key quantitative indicator connecting "clustering and grouping" and "anomaly identification".

[0099] In one possible implementation, S6 specifically includes:

[0100] S601: Based on the clustering results, obtain the membership degree of each user to each cluster center.

[0101] S602: Calculate the weighted average electricity consumption of each user in the high-electricity-consumption cluster and the low-electricity-consumption cluster based on each membership degree:

[0102]

[0103] in, This represents the weighted average electricity consumption of the j-th cluster, where n represents the total number of users. This represents the membership degree of the i-th user to the j-th cluster. This represents the actual electricity consumption of the i-th user. Indicates high power consumption clusters, This indicates a low-power cluster.

[0104] S603: Calculate the anomaly score for each user based on the weighted average electricity consumption:

[0105]

[0106] in, This represents the abnormal score of the i-th user. This represents the weighted average electricity consumption of users within high-electricity-consumption clusters. This represents the weighted average electricity consumption of a user within a low-electricity cluster.

[0107] In this embodiment of the invention, by utilizing the membership information of fuzzy clustering, the invention can comprehensively reflect the similarity between users in high-electricity-consumption clusters and low-electricity-consumption clusters. A weighted average is used to calculate the typical electricity consumption level of each cluster, achieving soft-based judgment of user behavior rather than a single threshold judgment. This mechanism considers the fuzzy boundaries between different user patterns, making anomaly detection more consistent with actual electricity consumption characteristics. Simultaneously, by calculating anomaly scores, the degree of deviation of users from normal high-electricity-consumption patterns can be quantitatively described. When a user's electricity consumption is significantly lower than the normal pattern they should belong to, the anomaly score will increase significantly, thus intuitively reflecting potential electricity theft or abnormal metering behavior.

[0108] S7: Determine if each user's abnormal score is greater than the preset abnormal score. If so, classify the user as a suspected electricity thief and proceed to S8. Otherwise, classify the user as a normal user.

[0109] It should be noted that those skilled in the art can set the preset abnormal score size according to actual needs, and this invention does not limit this.

[0110] S8: Based on the frequency domain characteristics of suspected electricity theft users, identify the electricity theft users using a random forest-based electricity theft detection model.

[0111] In one possible implementation, S8 specifically includes:

[0112] S801: Construct the original dataset based on historical frequency domain feature data with known labels.

[0113] S802: Randomly select multiple bootstrap samples from the original dataset. Each bootstrap sample contains multiple sample data.

[0114] S803: Construct multiple decision trees based on each bootstrap sample:

[0115]

[0116] in, h represents the prediction value of the b-th decision tree on the input data x, where x represents the input data point. b Let M represent the tree structure of the b-th decision tree, and let μ represent the total number of leaf nodes in the decision tree. m R represents the average of the target values ​​of all samples in the m-th leaf node. m Let I() represent the sample set of the m-th leaf node, and let I() represent the indicator function. This indicates that sample x belongs to leaf node R. m , This indicates that sample x does not belong to the leaf node R. m .

[0117] In one possible implementation, S803 specifically includes:

[0118] S8031: Select multiple splitting variables from the bootstrap sample.

[0119] S8032: Select a split point among the split variables and divide each split variable into two subsets, left and right, based on the split point.

[0120] S8033: Determine the optimal split point with the objective of minimizing the sum of squared residuals for each subset:

[0121]

[0122] Where min represents minimization, μ1 represents the mean of the objective variable in the left subset, and x i Let y represent the feature vector of the i-th sample, R1 represent the left subset after splitting, and y i Let represent the target variable of the i-th sample, μ2 represent the mean of the target variable in the right subset, R2 represent the right subset after splitting, j represent the feature, and s represent the split point.

[0123] It should be noted that when a feature is selected as a node splitting variable, its splitting can lead to a decrease in the sum of squared residuals; this decrease reflects the contribution of that feature to the classification result. The model accumulates and averages the splitting contributions of each feature across all decision trees to obtain the importance score for each feature. In this way, the system can automatically identify key features that significantly influence electricity theft, such as frequency domain fluctuations, electricity stability indicators, or changes in cluster membership, thereby improving the model's interpretability and transparency.

[0124] S8034: Based on the optimal split point, split the current node into a left child node and a right child node, and recursively execute S8031 to S8034 on the left child node and the right child node.

[0125] S8035: When the number of sample data in the self-service sample is lower than the preset number of sample data or the depth of the tree reaches the maximum depth, stop splitting and complete the construction of each decision tree.

[0126] S804: Combine the decision trees to construct an electricity theft detection model:

[0127]

[0128] in, Let B represent the final prediction value of the random forest for the input data x, where B represents the total number of trees in the random forest, x represents the input data point, and h represents the final prediction value. b This represents the tree structure of the b-th decision tree. This represents the predicted value of the b-th decision tree on the input data x.

[0129] S805: Input the various frequency domain features into the electricity theft detection model to identify electricity theft users.

[0130] Specifically, a random forest model is used to make the final determination of suspected electricity theft users. First, the system constructs a training dataset using labeled historical user frequency domain feature data and randomly selects multiple bootstrap samples to train multiple decision trees. Each decision tree is trained independently on different sample and feature subsets, generating a corresponding tree structure model. When splitting nodes, the decision trees aim to minimize the sum of squared residuals, selecting the optimal splitting features and split points to improve classification accuracy. After all decision trees are trained, the system integrates them to form a random forest model. For a new input sample (i.e., the feature vector of a suspected electricity theft user), the model inputs it into each decision tree for prediction and averages the outputs of all trees to obtain the final prediction value. This prediction value can be considered as the probability that the user has engaged in electricity theft. If the probability is greater than a preset threshold, the system classifies the user as an electricity theft user; otherwise, it classifies them as a normal user.

[0131] In this embodiment of the invention, the random forest model constructs multiple independent decision trees through bootstrapping and outputs the final prediction result using voting or averaging, effectively reducing the risk of overfitting from a single decision tree. Each tree is trained on different feature subsets and sample subsets, giving the model strong randomness and robustness, thus maintaining high accuracy in identifying complex user electricity consumption characteristics. Simultaneously, during the model training phase, the random forest evaluates the contribution of different features to the split by minimizing the sum of squared residuals at each node, thereby establishing a feature importance evaluation mechanism. This enables more stable classification decisions, significantly reducing false alarms and false negatives, and improving the accuracy of identifying electricity theft users.

[0132] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0133] In this invention, by jointly analyzing observation data from the transformer side and electricity consumption data from the user side, an energy transmission correlation between the power supply end and the power consumption end is established, thereby enhancing the ability to locate areas with abnormal electricity consumption. Through cluster analysis of user frequency domain characteristics, multiple electricity consumption pattern groups are constructed, and the degree of user affiliation in each group is quantified based on a membership function, thus establishing a correlation model between individual users and different electricity consumption behavior groups. Furthermore, by combining an adaptive anomaly scoring mechanism and an additive tree model, the final intelligent judgment is achieved, effectively breaking through the dependence on static thresholds or fixed classification models, and significantly improving the accuracy and reliability of the detection results.

[0134] Reference manual attached Figure 2 The diagram shows a schematic of the structure of an electricity theft detection system based on smart meter data provided by the present invention.

[0135] The present invention also provides a smart meter data-based electricity theft detection system 20, applied to the above-mentioned smart meter data-based electricity theft detection method, comprising:

[0136] Processor 201.

[0137] The memory 202 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 201, they implement the electricity theft detection method based on smart meter data as described in the method embodiment.

[0138] The electricity theft detection system 20 based on smart meter data provided by the present invention can execute the above-mentioned electricity theft detection method based on smart meter data and achieve the same or similar technical effects. To avoid duplication, the present invention will not elaborate further.

[0139] It should be understood that the processor in the embodiments of the present invention can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0140] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0141] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0142] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0143] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0144] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0145] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0146] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0147] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0148] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0149] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0150] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0151] This invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the electricity theft detection method based on smart meter data as described in the method embodiment.

[0152] The present invention provides a computer-readable storage medium that can implement the steps and effects of the electricity theft detection method based on smart meter data in the above-described method embodiments. To avoid repetition, the present invention will not repeat the details.

[0153] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0154] The following points need to be explained:

[0155] (1) The accompanying drawings of the embodiments of the present invention only involve the structures involved in the embodiments of the present invention. Other structures can refer to the general design.

[0156] (2) For clarity, the thickness of layers or regions is enlarged or reduced in the drawings used to describe embodiments of the invention, i.e., these drawings are not drawn to scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being “above” or “below” another element, the element may be “directly” located “above” or “below” the other element or there may be intermediate elements.

[0157] (3) Where there is no conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other to obtain new embodiments.

[0158] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. The scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting electricity theft based on smart meter data, characterized in that, include: S1: Acquire observation table data from each transformer side in the detection area and electricity consumption data from multiple users; S2: Based on the data from each observation table and the electricity consumption data, suspected areas of electricity theft are identified through comparative analysis. S3: Determine the ratio profile sequence of each user based on the observation table data and the corresponding electricity consumption data in the suspected electricity theft area; S4: Extract the frequency domain features of each of the ratio profile sequences; S5: Based on the frequency domain characteristics, the users are grouped using a clustering algorithm to obtain multiple different electricity consumption pattern groups; S6: Calculate the membership degree of each user to each of the electricity consumption mode groups, and calculate the anomaly score of each user based on each membership degree; S7: Determine whether the abnormal score of each user is greater than the preset abnormal score; If so, the user is identified as a suspected electricity thief, and the process proceeds to step S8; Otherwise, the user will be classified as a normal user; S8: Based on the frequency domain characteristics of the suspected electricity theft users, determine the electricity theft users using a random forest-based electricity theft detection model; Specifically, S4 includes: S401: Using the db1 wavelet basis, perform a 4-level discrete wavelet transform decomposition on the ratio profile sequence of each user; S402: In each decomposition layer, low-pass and high-pass filters are used to convolve and downsample the approximation coefficients of the previous layer to obtain the low-frequency and high-frequency components of each layer. S403: Extract the fourth-layer low-frequency components of each of the ratio profile sequences, and normalize each of the fourth-layer low-frequency components to obtain the frequency domain features of each of the ratio profile sequences. Specifically, S5 includes: S501: Initialize clustering parameters, wherein the clustering parameters include the number of clusters, fuzzy index, membership degree change threshold, and maximum number of iterations; S502: Construct the clustering objective function; S503: With the goal of minimizing the clustering objective function, iteratively update the membership degree and cluster center of each user; S504: If the maximum change in membership degree among each user is less than the membership degree change threshold or the current iteration number reaches the maximum iteration number, stop the iteration and complete the clustering of the electricity consumption pattern group; S505: Calculate the contour coefficient of each user and calculate the average contour coefficient based on each contour coefficient. S506: Determine whether the average profile coefficient is greater than the preset profile coefficient; if yes, determine that the clustering result is valid and proceed to S507; otherwise, return to S501 and re-cluster. S507: Define the updated cluster centers as different electricity consumption pattern groups; S508: Using the maximum membership principle, each user is assigned to the corresponding electricity consumption mode group.

2. The method for detecting electricity theft based on smart meter data according to claim 1, characterized in that, S1 specifically includes: S101: Deploy observation meters on each transformer side in the detection area to obtain data from multiple observation meters; S102: Obtain electricity consumption data of multiple users on each transformer side through smart meters installed by the users.

3. The method for detecting electricity theft based on smart meter data according to claim 1, characterized in that, S2 specifically includes: S201: Sum the electricity consumption data of each user corresponding to each transformer side to obtain the total electricity consumption data of multiple users; S202: Calculate the electricity consumption error value based on the observation table data of each transformer side and the corresponding total electricity consumption data of the user; S203: Calculate the dynamic power consumption error threshold corresponding to each transformer side; S204: Determine whether each of the power consumption error values ​​is less than the corresponding dynamic power consumption error threshold; if so, return to S1 and wait for the next round of detection; otherwise, mark the power supply area corresponding to the transformer side as the suspected power theft area.

4. The method for detecting electricity theft based on smart meter data according to claim 1, characterized in that, S3 specifically includes: S301: Calculate the ratio profile value based on the observation table data in the suspected electricity theft area and each of the electricity consumption data; S302: Extract the ratio profile sequence for each user based on each ratio profile value.

5. The method for detecting electricity theft based on smart meter data according to claim 1, characterized in that, S6 specifically includes: S601: Based on the clustering results, obtain the membership degree of each user to each cluster center; S602: Calculate the weighted average electricity consumption of each user in the high electricity consumption cluster and the low electricity consumption cluster based on each of the membership degrees; S603: Calculate the anomaly score for each user based on the weighted average electricity consumption of each user.

6. The method for detecting electricity theft based on smart meter data according to claim 1, characterized in that, S8 specifically includes: S801: Construct the original dataset based on historical frequency domain feature data of known labels; S802: Randomly select multiple bootstrap samples from the original dataset; wherein each bootstrap sample contains multiple sample data; S803: Construct multiple decision trees based on each of the aforementioned bootstrap samples; S804: Combine the decision trees to construct the electricity theft detection model; S805: Input each of the frequency domain features into the electricity theft detection model to determine the electricity theft user.

7. The method for detecting electricity theft based on smart meter data according to claim 6, characterized in that, Specifically, S803 includes: S8031: Select multiple splitting variables from the bootstrap sample; S8032: Select a split point among the split variables and divide each split variable into two subsets, left and right, based on the split point; S8033: Determine the optimal split point with the objective of minimizing the sum of squared residuals for each subset; S8034: Based on the optimal split point, divide the current node into a left child node and a right child node, and recursively execute S8031 to S8034 on the left child node and the right child node. S8035: When the number of sample data in the self-service sample is lower than the preset number of sample data or the depth of the tree reaches the maximum depth, stop splitting and complete the construction of each decision tree.

8. A theft detection system based on smart meter data, characterized in that, include: processor; A memory storing computer-readable instructions, which, when executed by the processor, implement the electricity theft detection method based on smart meter data as described in any one of claims 1 to 7.

Images