A gateway data association rule mining-based energy abnormal behavior rapid identification method and system

Abstract

The present application relates to the technical field of data, in particular to a kind of based on gateway data association rule mining's energy use abnormal behavior fast identification method and system.The present application considers the historical time series relationship of energy use data by time series association rule mining, can more comprehensively analyze the change trend and law of energy use data, so as to effectively capture potential abnormal behavior, also consider the association rule of multidimensional gateway data, reduce the omission or misjudgment possibly brought by single dimension data analysis, by comparing real-time gateway energy use data with historical data, it can be judged whether energy use node exists abnormal risk, by introducing the multiple judgment mechanism of association matching degree and abnormal comprehensive score, effectively reduce the risk of false alarm and miss, by accurately matching the historical data sequence of corresponding scene, combined with the comprehensive score of difference and similarity, the abnormal degree of energy use node can be finely judged, so as to improve the identification accuracy of abnormal behavior.

Description

Technical Field

[0001] This invention relates to the field of data technology, and in particular to a method and system for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining. Background Technology

[0002] Gateway data association rules refer to the process of mining the correlations and patterns between different devices by collecting energy consumption data from IoT devices or smart home environments. Gateways are usually central devices that connect various smart devices and are responsible for data collection, transmission and processing. In this context, gateway data association rule mining focuses on discovering potential energy consumption patterns by analyzing the relationships between devices. Association rules are a technique in data mining used to discover the correlations between items in a dataset. In energy consumption data, association rules can be used to identify potential correlations between the energy consumption behaviors of different devices or systems.

[0003] Current methods for identifying abnormal energy consumption behavior mainly involve quantitatively comparing target energy consumption data with benchmark data and judging whether an anomaly exists based on the degree of data difference. However, energy consumption data is usually a continuous process that changes over time, and energy consumption data at different time points are often related. If the judgment is based solely on the data difference at a single time point, and the data comparison requires traversing and calculating the entire energy consumption data point by point, it will not only fail to fully capture the dependencies in the time series, but also result in a lengthy data processing flow, which will lead to an inability to quickly and accurately reflect the actual abnormal state of the energy consumption node. Summary of the Invention

[0004] The main objective of this invention is to provide a method for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining, aiming to solve the technical problems in the prior art.

[0005] This invention proposes a method for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining, comprising: Obtain multi-dimensional gateway data and historical time-series data of multiple energy-consuming nodes within the gateway coverage area, and perform time-series association rule mining on the historical time-series data of multiple gateways to obtain a time-series association rule set; Multi-dimensional data association rule mining is performed on multiple multi-dimensional gateway data to obtain a multi-dimensional data association rule set, and an association rule library is constructed based on the multi-dimensional data association rule set and the time series association rule set; Obtain real-time gateway energy consumption data and real-time scenario information for each energy-consuming node, and match the corresponding target association rule subset from the association rule library based on each real-time scenario information; The association matching degree is obtained based on the energy consumption data of each real-time gateway and the subset of target association rules, and it is determined whether the association matching degree is less than a preset matching threshold. If the correlation matching degree is less than the preset matching threshold, it is initially determined that the energy-consuming node has an abnormal energy consumption risk, and the real-time gateway energy consumption data sequence of the energy-consuming node within the preset time window and the historical gateway data sequence of the corresponding scenario in the correlation rule base are obtained. Based on each real-time gateway energy consumption data sequence and historical gateway data sequence, obtain the corresponding data difference and sequence similarity, and obtain the corresponding anomaly comprehensive score based on each data difference and sequence similarity; Determine whether the overall anomaly score is less than a preset anomaly threshold; If the comprehensive score of the anomaly is less than the preset anomaly threshold, then it is finally determined that the energy-consuming node has abnormal energy consumption behavior; If the abnormal comprehensive score is not less than the preset matching threshold, the energy consumption node is determined to be normal.

[0006] Preferably, the step of performing time series association rule mining on the historical time series data of multiple gateways to obtain a time series association rule set includes: Obtain the timestamp field and the corresponding energy consumption parameter data from the historical time series data of each gateway, and sort the multiple energy consumption parameter data according to the chronological order of each timestamp field to obtain an ordered time series dataset; Obtain the time span and data density of the ordered time series dataset, and determine the time window size based on the time span and data density of the ordered time series dataset; The ordered time series dataset is divided into multiple sub-time series according to the time window size, and the stationarity of all the sub-time series is tested to obtain multiple non-stationary sub-time series and stationary sub-time series. Each non-stationary sub-time series is differentially processed to obtain the corresponding stationary sub-time series, and the time features of each stationary sub-time series are extracted using the sliding window method. A time series feature vector is constructed based on multiple time features, and a priori algorithm is used to mine the correlation between the time series feature vector and the parameter data in the time dimension, so as to obtain a time series association rule set.

[0007] Preferably, the step of performing multi-dimensional data association rule mining on multiple multi-dimensional gateway data to obtain a multi-dimensional data association rule set, and constructing an association rule base based on the multi-dimensional data association rule set and the time series association rule set, includes: Obtain multi-dimensional attribute data for each of the multi-dimensional gateway data, wherein the multi-dimensional attribute data includes continuous attribute data and discrete attribute data; Obtain the numerical range and data distribution characteristics of the continuous attribute data, and determine the discretization interval division criteria based on the numerical range and data distribution characteristics; According to the discretization interval division standard, each continuous attribute data is divided into discrete intervals to obtain the corresponding discretized continuous attribute data, and a unique code identifier is assigned to each of the discretized continuous attribute data and discrete attribute data. The corresponding discrete continuous attribute data and the original discrete attribute data are encoded according to each unique coding identifier to obtain a coded multidimensional dataset; A transaction matrix is ​​constructed based on the coded multidimensional dataset, and a frequent itemset mining is performed on the transaction matrix using a frequent pattern growth algorithm to obtain a multidimensional data association rule set. The time series association rule set and the multi-dimensional data association rule set are normalized and standardized, and the processed time series association rule set and multi-dimensional data association rule set are integrated and stored to obtain the association rule library.

[0008] Preferably, the step of matching the corresponding target association rule subset from the association rule base based on each of the real-time scene information includes: Extract key scene dimensions from the real-time scene information, and determine key fields for scene matching based on the key scene dimensions; From the association rule base, candidate association rule sets associated with the key fields of the scenario matching are selected, and the number of overlaps and matching accuracy between the applicable scenario tags and key scenario dimensions of each candidate rule in the candidate association rule set are obtained. Based on each number of overlaps and matching accuracy, obtain the corresponding scene matching score, and determine whether the scene matching score is less than the score threshold; If the scene matching score is not less than the score threshold, then the candidate rule corresponding to the scene matching score is marked as a preliminary matching rule; Obtain the support and confidence of each preliminary matching rule, and obtain the corresponding comprehensive priority score based on each support and confidence. The preliminary matching rules are sorted from high to low according to the comprehensive priority score, and a preset number of preliminary matching rules at the top of the sort are selected to obtain a subset of target association rules.

[0009] Preferably, the step of obtaining the association matching degree based on each of the real-time gateway energy consumption data and the target association rule subset includes: Obtain the rule antecedent conditions and rule consequent expected values ​​for each preliminary matching rule in the target association rule subset, and determine whether the real-time gateway energy consumption data meets the rule antecedent conditions; If the real-time gateway energy consumption data meets the rule antecedent conditions, then the preliminary matching rule corresponding to the rule antecedent conditions is marked as an associated matching antecedent rule; The antecedent matching rate is obtained by the ratio of the number of antecedent rules in the associated matching to the number of initially matched rules in the target associated rule subset; The corresponding successor deviation rate is obtained based on the real-time gateway energy consumption data and the expected value of the successor of each associated matching predecessor rule, and the average successor deviation rate is obtained based on multiple successor deviation rates. Obtain the rule confidence of each associated matching antecedent rule, and obtain the average confidence based on the multiple rule confidences; The consequent fit is obtained based on the average consequent deviation rate, and the correlation fit is obtained based on the consequent fit, average confidence level, and antecedent matching rate.

[0010] Preferably, the step of obtaining the corresponding data difference and sequence similarity based on each real-time gateway energy consumption data sequence and historical gateway data sequence includes: Extract the real-time parameter value and historical parameter value corresponding to each timestamp in each of the real-time gateway energy consumption data sequences and historical gateway data sequences, and obtain the absolute difference of the corresponding parameter based on each of the real-time parameter value and historical parameter value; The corresponding average absolute difference is obtained based on the absolute difference of multiple parameters, and the weighted sum is obtained by weighting the multiple average absolute differences. The relative difference of each parameter is obtained based on the absolute difference of each parameter and the historical parameter value, and the corresponding average relative difference is obtained based on multiple relative differences of the parameters. The weighted average relative difference is obtained by weighted summation of multiple average relative differences, and the data difference degree is obtained based on the weighted average relative difference and the weighted average absolute difference. A sequence alignment matrix is ​​constructed using the real-time gateway energy consumption data sequence as the query sequence and the historical gateway data sequence as the reference sequence. The Euclidean distance between each data point of the real-time gateway energy consumption data sequence and the historical gateway data sequence is obtained based on the sequence alignment matrix. Each Euclidean distance is normalized to obtain the corresponding standardized Euclidean distance, and the average Euclidean distance is obtained based on the multiple standardized Euclidean distances. The Pearson correlation coefficient algorithm is used to obtain the linear correlation coefficient between the real-time gateway energy consumption data sequence and the historical gateway data sequence, and the sequence similarity is obtained based on the linear correlation coefficient and the average Euclidean distance.

[0011] This application also provides a system for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining, including: The mining module acquires multi-dimensional gateway data and historical time-series data of multiple energy-consuming nodes within the gateway's coverage area, and performs time-series association rule mining on the historical time-series data of multiple gateways to obtain a set of time-series association rules. The matching module is used to obtain the real-time gateway energy consumption data and real-time scenario information of each energy-consuming node, and to match the corresponding target association rule subset from the association rule library according to each real-time scenario information. The first acquisition module is used to acquire the association matching degree based on each real-time gateway energy consumption data and the target association rule subset, and to determine whether the association matching degree is less than a preset matching threshold. If the correlation matching degree is less than the preset matching threshold, it is initially determined that the energy-consuming node has an abnormal energy consumption risk, and the real-time gateway energy consumption data sequence of the energy-consuming node within the preset time window and the historical gateway data sequence of the corresponding scenario in the correlation rule base are obtained. The second acquisition module is used to acquire corresponding data difference and sequence similarity based on each real-time gateway energy consumption data sequence and historical gateway data sequence, and to acquire corresponding anomaly comprehensive score based on each data difference and sequence similarity. The judgment module is used to determine whether the comprehensive anomaly score is less than a preset anomaly threshold; If the comprehensive score of the anomaly is less than the preset anomaly threshold, then it is finally determined that the energy-consuming node has abnormal energy consumption behavior; If the abnormal comprehensive score is not less than the preset matching threshold, the energy consumption node is determined to be normal.

[0012] Preferably, the first acquisition module includes: The first acquisition unit is used to acquire the rule antecedent conditions and rule consequent expected values ​​of each preliminary matching rule in the target associated rule subset, and to determine whether the real-time gateway energy consumption data meets the rule antecedent conditions. If the real-time gateway energy consumption data meets the rule antecedent conditions, then the preliminary matching rule corresponding to the rule antecedent conditions is marked as an associated matching antecedent rule; The second acquisition unit is used to acquire the antecedent matching rate based on the ratio of the number of associated matching antecedent rules to the number of initially matched rules in the target associated rule subset; The third acquisition unit is used to obtain the corresponding successor deviation rate based on the real-time gateway energy consumption data and the expected value of the rule successor of each associated matching antecedent rule, and to obtain the average successor deviation rate based on multiple successor deviation rates. The fourth acquisition unit is used to acquire the rule confidence of each associated matching antecedent rule, and to acquire the average confidence based on the multiple rule confidences; The fifth acquisition unit is used to acquire the consequent fit degree based on the average consequent deviation rate, and to acquire the correlation fit degree based on the consequent fit degree, the average confidence degree and the antecedent matching rate.

[0013] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method for rapid identification of abnormal energy use behavior based on gateway data association rule mining.

[0014] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method for rapid identification of abnormal energy use behavior based on gateway data association rule mining.

[0015] The beneficial effects of this invention are as follows: By incorporating historical time-series relationships into energy consumption data through time-series association rule mining, this invention can more comprehensively analyze the changing trends and patterns of energy consumption data, thereby effectively capturing potential abnormal behaviors. It not only mines association rules for time-series data but also considers association rules for multi-dimensional gateway data, thus constructing a comprehensive association rule library. Through this multi-dimensional association analysis, potential abnormal risks can be identified more precisely, reducing omissions or misjudgments that may result from single-dimensional data analysis, effectively improving the identification of abnormal energy consumption behaviors. This is further enhanced by comparing real-time gateway energy consumption data with historical data. Yes, it can quickly determine whether there are abnormal risks in energy-consuming nodes. Especially when facing real-time monitoring and dynamically changing application scenarios, its response speed and adaptability are more flexible and rapid than traditional methods. The addition of real-time scenario information enables the system to automatically adjust the identification rules in dynamic environments, improving its ability to cope with complex scenarios and sudden abnormal situations. By introducing a multi-judgment mechanism of correlation matching degree and comprehensive anomaly score, the risk of false alarms and missed alarms is effectively reduced. By accurately matching the historical data sequence of the corresponding scenario and combining the comprehensive score of difference and similarity, the degree of anomaly of energy-consuming nodes can be judged in a refined manner, thereby improving the accuracy of abnormal behavior identification. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of a method flow according to an embodiment of the present invention.

[0017] Figure 2 This is a schematic diagram of the system structure according to an embodiment of the present invention.

[0018] Figure 3 This is a schematic diagram of the internal structure of a computer device according to an embodiment of this application.

[0019] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0021] like Figure 1 As shown, this application provides a method for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining, including: S1. Obtain multi-dimensional gateway data and gateway historical time series data of multiple energy-consuming nodes within the gateway coverage area, and perform time series association rule mining on the multiple gateway historical time series data to obtain a time series association rule set; S2. Perform multi-dimensional data association rule mining on multiple multi-dimensional gateway data to obtain a multi-dimensional data association rule set, and construct an association rule library based on the multi-dimensional data association rule set and the time series association rule set; S3. Obtain real-time gateway energy consumption data and real-time scenario information for each energy-consuming node, and match the corresponding target association rule subset from the association rule library based on each real-time scenario information; S4. Obtain the association matching degree based on each real-time gateway energy consumption data and target association rule subset, and determine whether the association matching degree is less than a preset matching threshold; If the correlation matching degree is less than the preset matching threshold, it is initially determined that the energy-consuming node has an abnormal energy consumption risk, and the real-time gateway energy consumption data sequence of the energy-consuming node within the preset time window and the historical gateway data sequence of the corresponding scenario in the correlation rule base are obtained. S5. Obtain the corresponding data difference and sequence similarity based on each real-time gateway energy consumption data sequence and historical gateway data sequence, and perform a weighted summation based on each data difference and sequence similarity to obtain the corresponding anomaly comprehensive score; S6. Determine whether the comprehensive abnormal score is less than a preset abnormal threshold; If the comprehensive score of the anomaly is less than the preset anomaly threshold, then it is finally determined that the energy-consuming node has abnormal energy consumption behavior; If the abnormal comprehensive score is not less than the preset matching threshold, the energy consumption node is determined to be normal.

[0022] As described in steps S1-S6 above, multi-dimensional gateway data refers to energy-related data collected by the gateway within its coverage area, describing the operating status of energy-consuming nodes from multiple attribute dimensions. Multi-dimensional gateway data encompasses historical and near-real-time data, organized around multi-dimensional attributes. Each data point contains multiple attribute dimensions, emphasizing multi-dimensional coverage to uncover the relationships between different energy-consuming attributes and support the construction of multi-dimensional data association rule sets. These include energy-consuming parameter dimensions, device status dimensions, and environmental association dimensions. Gateway historical time-series data refers to historical energy-consuming data related to energy-consuming nodes that the gateway has continuously collected and stored over a past period. Gateway historical time-series data only contains historical data from the past period and is strongly... Adjusting the temporal continuity, using timestamps as the core organizational logic, and forming a continuous sequence in chronological order, is the core data for time series association rule mining. It is used to capture the dependencies and historical patterns of energy consumption data over time, including time-series energy consumption data, historical scenario data, and historical anomaly records. Real-time gateway energy consumption data refers to the energy consumption data collected by the gateway in real time from the current operating status of energy consumption nodes. Real-time gateway energy consumption data only contains data from the current moment or the most recent short period of time. With real-time performance as its core characteristic, the data is updated frequently and has strong timeliness. It is the core data for matching with the target association rule subset and judging whether there is a real-time anomaly risk in energy consumption nodes, including real-time energy consumption parameters, real-time status data, and real-time scenario data.

[0023] It should be noted that real-time scenario information refers to the environmental and operational scenario data related to the current energy consumption behavior of an energy-consuming node, which is collected in real time when energy consumption anomalies are identified. The correlation matching degree is a quantitative indicator that measures the degree of fit between the real-time gateway energy consumption data of the energy-consuming node and the target correlation rule subset matched from the correlation rule library. The data difference degree is a quantitative indicator that measures the magnitude of the difference in energy consumption parameter values ​​between the real-time gateway energy consumption data sequence of the energy-consuming node within a preset time window and the historical gateway data sequence in the corresponding scenario in the correlation rule library. The sequence similarity is a quantitative indicator that measures the degree of fit between the real-time gateway energy consumption data sequence of the energy-consuming node and the historical gateway data sequence in the time dimension in terms of the changing trend and fluctuation pattern.

[0024] Traditional anomaly detection methods typically rely on static threshold comparisons or historical benchmark data comparisons, usually requiring individual calculations and comparisons for each data point. This not only involves lengthy computational processes but also, due to a lack of consideration for the time-series dependencies and complex changes in data, may overlook anomalies reflected in the time dimension. This invention, through time-series association rule mining, can automatically discover regular and irregular anomalies in large amounts of historical data through association relationships, significantly reducing the need to traverse the entire dataset and improving identification speed and accuracy. For example, anomalies at a particular energy consumption node are often closely related to previous energy consumption behavior, thus accurately capturing changes in time correlation and avoiding errors that may occur in single-point data difference analysis. This improves the accuracy and timeliness of energy consumption anomaly identification. Time-series association rules can automate rule mining, greatly shortening data analysis time, improving work efficiency, and simultaneously enhancing the accuracy and reliability of anomaly detection. By performing multi-dimensional data association rule mining on multiple multi-dimensional gateway data, it is possible to... This technology enables comprehensive analysis of energy consumption data from multiple dimensions. By summarizing the inherent relationships between data, it reduces redundant calculations and is more efficient than traditional point-by-point comparisons. Multi-dimensional data association rule mining focuses on the interrelationships between data dimensions, revealing complex interaction patterns between various energy consumption data dimensions. For example, by analyzing the relationship between power, current, and voltage, it can identify problems such as overload and leakage in equipment. This effectively extracts the correlations between different data dimensions, helping to achieve more comprehensive anomaly identification. By constructing a joint association rule base for multi-dimensional data and time series data, and combining the multi-dimensional data association rule set with the time series association rule set, the association rule base can not only perform intelligent reasoning based on the characteristics of energy consumption data, greatly shortening the anomaly identification time, but also predict and judge energy consumption patterns based on time changes. This allows for rapid determination of whether energy consumption nodes are in an abnormal state. Combining the association rule set of time series and multi-dimensional data can more comprehensively and accurately describe the behavior patterns of energy consumption nodes, providing a solid foundation for subsequent anomaly detection.

[0025] Many existing technologies rely solely on fixed data for judgment, neglecting the impact of external factors on energy consumption behavior. This invention, however, combines real-time scenario information to more accurately understand the background of data fluctuations, avoiding false alarms in non-abnormal situations. Based on the energy consumption characteristics of different scenarios, it selects the most relevant subset of rules from a rule base for comparison, improving not only the system's recognition accuracy but also significantly increasing computational efficiency by reducing the number of rules to be processed. Dynamic fusion of scenario information significantly reduces false alarms and missed alarms caused by scenario differences. Quantitative matching degree accurately measures the degree of conformity between real-time and historical data, avoiding simple threshold judgments. This measurement method can more flexibly handle complex energy consumption patterns, especially when there are minor fluctuations, avoiding misjudgments. Matching degree, as a core parameter, helps to quickly... Determining the existence of abnormal energy consumption risks is more accurate than simply calculating the degree of difference in capturing potential correlations between data, thus improving identification accuracy. By comprehensively calculating the correlation matching degree, judgments can be made based on the overall trend and pattern of the data, avoiding false alarms or missed alarms caused by relying solely on static thresholds. The preset matching threshold provides a flexible standard. By judging whether the correlation matching degree is lower than the threshold, preliminary data screening can be performed, avoiding the need for manually setting fixed and erroneous thresholds, and improving the automation and intelligence level of the system. By acquiring and comparing real-time data sequences within a preset time window, continuous changes in energy consumption patterns can be captured, rather than just data from a single moment. This better reflects the evolution process of abnormal energy consumption. By setting matching thresholds and combining them with data within the time window, the long-term trends and changes of energy consumption nodes can be comprehensively reflected.

[0026] Data dissimilarity quantifies the specific differences between two datasets, while sequence similarity reflects the trend and periodicity of data changes. This invention, by comprehensively using both dissimilarity and similarity dimensions to assess anomalies, can more comprehensively capture abnormal behavior and further quantify the degree of anomaly. This avoids misjudgments caused by a single indicator. For example, data dissimilarity may be small, but the sequence change is abnormal. Relying solely on the dissimilarity indicator can easily overlook these details. By combining sequence similarity and dissimilarity, it can better reflect complex energy consumption anomalies. By judging whether the comprehensive score is below the anomaly threshold, it can accurately determine whether to judge energy consumption anomalies. Through preset thresholds and comprehensive scores, the system can flexibly adjust the anomaly judgment criteria according to the characteristics and data conditions of different energy consumption nodes, avoiding the incompatibility of fixed standards applied to different nodes. By combining comprehensive scores with threshold judgments, it can more dynamically and accurately deal with various energy consumption situations, reducing misjudgments and omissions. This invention, through the advantages of time series association rules and multi-dimensional data rule mining, can comprehensively capture energy consumption anomalies from multiple dimensions and dynamically adjust them in combination with real-time scene information, effectively avoiding the misjudgment and omission problems in traditional methods.

[0027] In one embodiment, step S1, which involves mining time series association rules from multiple historical time series data of the gateways to obtain a time series association rule set, includes: S11. Obtain the timestamp field and the energy consumption parameter data under the corresponding timestamp field in the historical time series data of each gateway, and sort the multiple energy consumption parameter data according to the time sequence of each timestamp field to obtain an ordered time series dataset. S12. Obtain the time span and data density of the ordered time series dataset, and determine the time window size based on the time span and data density of the ordered time series dataset; S13. Divide the ordered time series dataset into multiple sub-time series according to the time window size, and perform stationarity tests on all the sub-time series to obtain multiple non-stationary sub-time series and stationary sub-time series. S14. Perform difference processing on each of the non-stationary sub-time series to obtain the corresponding stationary sub-time series, and use the sliding window method to extract the time features of each of the stationary sub-time series. S15. Construct a time series feature vector based on multiple time features, and use a priori algorithm to mine the correlation between the time series feature vector and the parameter data in the time dimension to obtain a time series association rule set.

[0028] As described in steps S11-S15 above, the timestamp field is a specific data field used to record the collection time of historical time-series data (basic parameter data of energy-consuming nodes, operating environment data, and device status data) of the gateway. The time span is calculated by obtaining the start timestamp corresponding to the first data in the ordered time series dataset and the end timestamp corresponding to the last data, and calculating the difference between the start and end timestamps. By counting the total number of data in the ordered time series dataset and calculating the number of data collected per unit time based on the ratio of the total number to the time span, the data density can be obtained. The basic range of the time window is determined based on the time span, and the basic range is adjusted according to the data density to obtain the time window. The window size is determined by various factors. For example, if the time span is less than 24 hours, the basic range is set to 10-60 minutes; if the time span is between 24-72 hours, the basic range is set to 1-3 hours; and if the time span is greater than 72 hours, the basic range is set to 3-8 hours. If the data density is greater than the preset high-density threshold (e.g., 5 records / minute), the lower limit of the basic range is increased by 5-15 minutes to obtain the corresponding time window size, so as to reduce the time window interval to retain more data details. If the data density is less than the preset low-density threshold (e.g., 1 record / 5 minutes), the upper limit of the basic range is increased by 10-30 minutes to obtain the corresponding time window size, so as to expand the time window interval to ensure that there is enough data within the window.

[0029] It should be noted that the steps for testing the stationarity of sub-time series include: calculating the difference between two adjacent data points in each non-stationary sub-time series using the first-order differencing method to obtain a first-order differencing sequence; performing a stationarity test on the first-order differencing sequence again; if the first-order differencing sequence is stationary, then the first-order differencing sequence is considered a stationary sub-time series; if the first-order differencing sequence is still non-stationary, then performing a second difference on the first-order differencing sequence using the second-order differencing method to obtain a second-order differencing sequence, repeating the above differencing and stationarity test steps until a stationary differencing sequence is obtained.

[0030] Existing methods for identifying energy consumption anomalies often neglect the continuity and dependencies of the time dimension in the data, or they mix timestamp fields and energy consumption parameter data, resulting in an inability to accurately reflect the actual temporal evolution of energy consumption behavior. Existing methods, by comparing target energy consumption data with baseline data in a single step, fail to identify the dependencies between energy consumption data at different points in time. This invention, however, explicitly extracts the timestamp field and the corresponding energy consumption parameter data, and sorts them chronologically. This not only maintains the temporal continuity of the data but also ensures the orderliness of the time series, enabling subsequent anomaly detection algorithms to capture the dependencies in the time dimension and improving anomaly identification. The accuracy of anomaly detection is improved by enabling the algorithm to determine whether abnormal behavior has occurred based on the trend changes over the entire time period, rather than relying solely on data differences at a single point in time. This invention dynamically determines the size of the time window based on the time span and data density, allowing the algorithm to adjust the time window according to actual energy consumption data changes. This improves the adaptability to different energy consumption patterns and allows for the allocation of suitable windows to data in different time periods, avoiding misjudgments of high-density and low-density data. Dynamically adjusting the window size can effectively improve the flexibility and accuracy of anomaly behavior recognition, especially in high-density and low-density data scenarios, maintaining a high recognition rate.

[0031] This invention divides time series data into stationary and non-stationary subsequences through stationarity testing, which helps identify potential trends and seasonal fluctuations in the data. Non-stationary subsequences are further processed to eliminate trend and seasonal effects, allowing for further analysis in a stationary state and improving the robustness of anomaly detection. By removing non-stationary factors in advance, noise and irregularities in the data are eliminated, enabling subsequent analysis to focus on actual energy consumption anomalies and significantly improving analytical accuracy. Differential processing effectively removes trend components from non-stationary time series, bringing the data to a stationary state and better capturing trends in energy consumption behavior. The sliding window method can extract temporal features from the time series, such as periodicity and trends. To help the model better understand the temporal patterns of energy consumption data, the analyzability of the data is improved through differencing and stationarity transformation. The time features extracted by sliding window enhance the model's ability to capture time patterns, enabling subsequent anomaly detection to more accurately reflect the dynamic changes in energy consumption behavior. By constructing time series feature vectors and mining the correlations between time series, potential time dependencies and patterns in the time series can be captured, thereby identifying potential abnormal patterns in energy consumption behavior. By fully utilizing the temporal dimension information of the time series data, anomaly identification is not only based on the current state but also considers the influence of the gateway's historical time series data. Through association rule mining, analysis can be performed from the perspective of the overall time series, significantly improving the accuracy and reliability of anomaly identification.

[0032] In one embodiment, step S2, which involves mining multi-dimensional data association rules from multiple multi-dimensional gateway data to obtain a multi-dimensional data association rule set, and constructing an association rule base based on the multi-dimensional data association rule set and the time series association rule set, includes: S21. Obtain multi-dimensional attribute data for each of the multi-dimensional gateway data, wherein the multi-dimensional attribute data includes continuous attribute data and discrete attribute data; S22. Obtain the numerical range and data distribution characteristics of the continuous attribute data, and determine the discretization interval division criteria based on the numerical range and data distribution characteristics; S23. Divide each continuous attribute data into discrete intervals according to the discretization interval division criteria to obtain the corresponding discretized continuous attribute data, and assign a unique code identifier to each discretized continuous attribute data and discrete attribute data. S24. Encode the corresponding discrete continuous attribute data and the original discrete attribute data according to each unique coding identifier to obtain a coded multidimensional dataset; S25. Construct a transaction matrix based on the encoded multidimensional dataset, and use a frequent pattern growth algorithm to perform frequent itemset mining on the transaction matrix to obtain a multidimensional data association rule set; S26. The time series association rule set and the multi-dimensional data association rule set are normalized and standardized, and the processed time series association rule set and the multi-dimensional data association rule set are integrated and stored to obtain the association rule library.

[0033] As described in steps S21-S26 above, the multi-dimensional attribute data refers to a multi-type data set extracted from the multi-dimensional gateway data to describe the characteristics of multiple energy-consuming nodes and their operating environment. This includes data on dimensions such as energy-consuming node type, energy-consuming device power, operating time, ambient temperature, and voltage stability. The step of constructing a transaction matrix based on the encoded multidimensional dataset includes: obtaining the encoded attribute vector of each energy-consuming node in the encoded multidimensional dataset, and extracting the attribute item set of each energy-consuming node based on the encoded attribute vector. The attribute item set contains the encoded identifier corresponding to each attribute. The unique encoded identifiers in all attribute item sets are used as column labels, and one energy consumption record of each energy-consuming node is used as the row label of the transaction matrix to construct the transaction matrix.

[0034] The steps for integrating and storing the processed time-series association rule sets and multi-dimensional data association rule sets to obtain an association rule library include: extracting the core information of each processed time-series association rule set and multi-dimensional data association rule set, wherein the core information includes rule antecedent, rule consequent, support, confidence, lift, and applicable scenario label; formulating rule classification standards based on the applicable scenario labels, and classifying the rules in the time-series association rule sets and multi-dimensional data association rule sets according to the rule classification standards to obtain multiple rule categories; assigning a unique index code to each rule based on each core information, and constructing a mapping relationship table between the index code and the rule core information; setting up a rule category storage partition, a rule core information storage field, and an index mapping table storage module, filling the rule category into the rule category storage partition, filling the core information into the rule core information storage field, and storing the mapping relationship table into the index mapping table storage module, thus completing the integration and storage of the time-series association rule sets and multi-dimensional data association rule sets to obtain the association rule library.

[0035] This invention, by collecting historical data from each gateway in multiple dimensions, enables the understanding and analysis of changes in energy consumption data from multiple perspectives, providing a comprehensive view of the actual situation. Simultaneous collection of continuous and discrete data allows for better capture of details in the energy consumption process, reducing missed detections and false positives. Collecting multi-dimensional data effectively improves the representativeness of the dataset, enabling the model to provide more accurate anomaly identification in practical applications. Since continuous attribute data typically has a wide numerical distribution, directly applying discretization standards can easily lead to information loss or low accuracy. By analyzing the numerical range and data distribution characteristics, a suitable discretization interval can be determined, ensuring more accurate representation of the discretized data and avoiding oversimplification. Defining intervals based on data distribution characteristics helps preserve... By retaining key features of the data, the discretized data can not only be used to mine association rules, but also effectively capture the dynamic characteristics of the data. It can effectively avoid errors caused by unreasonable partitioning. Through reasonable discretization interval partitioning, unnecessary calculations can be reduced, the efficiency of subsequent mining algorithms can be improved, and the high-dimensional sparse matrix problem caused by inappropriate interval partitioning can be avoided. By assigning a unique code to each data point, confusion between data from different sources and in different formats can be avoided during the mining process, ensuring data consistency and reducing misidentification and errors caused by inconsistent data types. After unifying all attribute data through coding identification, data storage, management, and scheduling can be simplified, making multi-dimensional data from different sources more operable in subsequent analysis and improving data comparability.

[0036] It's important to note that by uniformly encoding all attribute data, the standardization of data processing is ensured, guaranteeing consistency across all data elements within the entire dataset. This facilitates subsequent multi-dimensional data analysis. Converting all attribute data to a unified code creates a multidimensional dataset, allowing for more standardized operations in association rule mining, reducing errors and improving the accuracy of mining rules. Unified encoding also reduces the complexity of data transformation during subsequent processing, increasing speed and efficiency, especially noticeable when dealing with large-scale data. The construction of the transaction matrix transforms the data into a mining-friendly format, while the frequent pattern growth algorithm efficiently extracts frequent itemsets. This algorithm boasts high computational efficiency and good scalability, enabling the discovery of more representative association rules from complex, large-scale data. By extracting association rules from multi-dimensional data, deep-seated dependencies between different attributes can be identified, leading to the identification of anomalies. The identification process is more accurate. For example, abnormal energy consumption during certain time periods may be related to changes in multi-dimensional data such as equipment status and external environment. By mining multi-dimensional association rules, the accuracy of identification can be improved, avoiding misjudgments based solely on a single data source. The frequent pattern growth algorithm can flexibly adapt to different types of datasets, is suitable for large-scale and complex energy consumption data, and can gradually improve the mining effect as the amount of data increases, demonstrating good adaptability. By normalizing time series association rules and multi-dimensional data association rules, the scale differences between different rule sets can be eliminated, allowing them to be fused under the same standard. Combining time series data with multi-dimensional data and standardizing the process can better capture the correlation between time series data and other dimensions of data, thereby improving the accuracy of identifying abnormal energy consumption behavior. By integrating and storing the two types of rules to form a unified rule base, rules can be managed and called more conveniently, and rule matching and anomaly detection can be performed quickly in practical applications, improving the system's response speed.

[0037] In one embodiment, step S3, which involves matching a corresponding subset of target association rules from the association rule base based on each of the real-time scene information, includes: S31. Extract the key scene dimensions from the real-time scene information, and determine the key fields for scene matching based on the key scene dimensions; S32. Filter out candidate association rule sets associated with the key fields of the scenario matching from the association rule base, and obtain the number of overlaps and matching accuracy between the applicable scenario tags and key scenario dimensions of each candidate rule in the candidate association rule set. S33. Perform a weighted summation based on each number of overlaps and matching precision to obtain the corresponding scene matching score, and determine whether the scene matching score is less than the score threshold. If the scene matching score is not less than the score threshold, then the candidate rule corresponding to the scene matching score is marked as a preliminary matching rule; S34. Obtain the support and confidence of each preliminary matching rule, and perform a weighted summation based on each support and confidence to obtain the corresponding comprehensive priority score; S35. Sort the preliminary matching rules from high to low according to the comprehensive priority score, and select the first preset number of preliminary matching rules to obtain the target association rule subset.

[0038] As described in steps S31-S35 above, the scene matching key fields are index fields determined based on key scene dimensions and used to locate the matching rules in the association rule library. They serve as a bridge connecting real-time scene information and the association rule library. Each field corresponds one-to-one with a key scene dimension. The steps for determining the scene matching key fields based on the key scene dimensions include: determining the corresponding core description parameters by analyzing the attribute characteristics of each key scene dimension; retrieving the rule storage fields of the rule core information from the association rule library based on each core description parameter to obtain an initial field set; performing association verification on the fields in the initial field set to determine whether each field uniquely corresponds to a core description parameter; and handling cases where the field does not uniquely correspond to the core description parameter. The field attributes are supplemented and refined according to the definition document of the rules stored in the field to obtain the validated field set. The historical matching records of each field in the validated field set are used to calculate the matching accuracy and calling frequency of the corresponding field in the historical scene matching process. The matching validity score of the corresponding field is calculated by weighted summation based on the matching accuracy and calling frequency of each field. Fields with matching validity scores not lower than the validity score threshold are selected to obtain the valid field set. Redundancy detection is performed on the fields in the valid field set to determine whether there are redundant fields (fields with repeated descriptions or overlapping functions). If redundant fields exist, the fields with higher matching validity scores are retained to obtain the key fields for scene matching.

[0039] It should be noted that support refers to the frequency of occurrence of the preliminary matching rule in the gateway's historical time-series dataset, and confidence refers to the probability that the expected value of the consequent will be true given that the antecedent conditions of the preliminary matching rule are met. Before obtaining the corresponding comprehensive priority score by weighted summation of support and confidence, and the corresponding scenario matching score by weighted summation of overlap and matching accuracy, it is necessary to perform standard normalization processing on support and confidence, overlap and matching accuracy respectively. The method for filtering candidate association rule sets is to retrieve the index mapping table corresponding to the key fields of the scenario matching from the rule index system of the association rule library, and then filter the candidate association rule sets in the association rule library whose core rule information contains the key scenario dimension according to the index mapping table. The candidate association rule set includes multiple candidate rules containing the core rule information of the key scenario dimension. After obtaining the target association rule subset, it is also necessary to verify the validity of the target association rule subset, and check whether there are logical conflicts or missing core information in the preliminary matching rules in the target association rule subset. If there are conflicts, the rule with higher priority is retained according to the comprehensive priority score. If there is missing information, it is supplemented from the association rule library to obtain the final target association rule subset.

[0040] This invention extracts and clarifies key scene dimensions, enabling more accurate capture of environmental and temporal changes. This allows anomaly detection to reflect real abnormal behaviors closely related to the scene. By filtering candidate rule sets from the association rule base and calculating their overlap and matching accuracy, meaningless comprehensive searches among a large number of candidate rules are effectively avoided. Precise filtering and quantification of the fit between rules and scenes improve the accuracy and efficiency of rule matching. Weighted summation of overlap and matching accuracy further avoids misjudgments caused by rule mismatch or noise. By comprehensively considering overlap and matching accuracy, the fit between rules and real-time scenes can be more comprehensively evaluated, avoiding bias from over-reliance on a single factor. Setting a score threshold to filter initial matching rules ensures that only rules showing high matching in the current scene can continue to subsequent processing. Setting a score threshold significantly improves the efficiency of the matching process and effectively avoids interference from irrelevant rules.

[0041] Understandably, by further calculating support and confidence based on the initial matching rules, a more comprehensive priority assessment can be provided for each candidate rule. Support reflects the prevalence of the rule in historical data, while confidence measures the credibility of the rule when applied to new data. Weighting and summing these two factors allows for a more accurate evaluation of the rule's actual effect and reliability, ensuring better anomaly detection in practical applications. By introducing a multi-dimensional rule evaluation mechanism, rules not only have high matching degrees but also maintain stability and effectiveness in big data environments. By ranking the rules, only the highest priority rules are included in the final matching rule set. Through ranking and filtering, the final output rule set is ensured to most effectively detect anomalies in the target scenario. By combining weighted scoring and priority ranking mechanisms, the rule selection has greater accuracy and flexibility, especially when dealing with large-scale data, ensuring a balance between efficiency and accuracy.

[0042] In one embodiment, step S4, which involves obtaining the association matching degree based on each subset of real-time gateway energy consumption data and target association rules, includes: S41. Obtain the rule antecedent conditions and rule consequent expected values ​​of each preliminary matching rule in the target association rule subset, and determine whether the real-time gateway energy consumption data meets the rule antecedent conditions. If the real-time gateway energy consumption data meets the rule antecedent conditions, then the preliminary matching rule corresponding to the rule antecedent conditions is marked as an associated matching antecedent rule; S42. Obtain the predecessor matching rate based on the ratio of the number of associated matching predecessor rules to the number of initially matched rules in the target associated rule subset; S43. Calculate the corresponding consequent deviation rate based on the real-time gateway energy consumption data and the expected value of the consequent of each associated matching antecedent rule, wherein the calculation formula is: ; Where C represents the consequent deviation rate, E represents the real-time gateway energy consumption data, and F represents the expected value of the rule consequent; S44. Obtain the average subsequent deviation rate based on the multiple subsequent deviation rates; S45. Obtain the rule confidence of each associated matching antecedent rule, and obtain the average confidence based on the multiple rule confidences; S46. Obtain the consequent fit based on the average consequent deviation rate, and calculate the correlation fit based on the consequent fit, average confidence level, and antecedent matching rate, wherein the calculation formula is: ; Where B represents the correlation matching degree, γ represents the average confidence level, c represents the consequent fit degree, and d represents the antecedent matching rate.

[0043] As described in steps S41-S46 above, the antecedent conditions of the rule refer to the preconditions for the rule's application, i.e., the conditions that the real-time gateway energy consumption data must meet, usually revolving around the numerical range or state of the energy consumption parameters. The expected value of the consequent of the rule refers to the target value or state of the energy consumption parameters predicted by the rule under the premise of meeting the antecedent conditions. It is the basis for judging whether the real-time data conforms to the rule. The antecedent matching rate is a quantitative indicator that measures the degree of conformity between the real-time gateway energy consumption data and the antecedent conditions of the initial matching rule. The consequent deviation rate is a quantitative indicator that measures the degree of deviation between the real-time gateway energy consumption data and the expected value of the consequent of the rule that meets the antecedent conditions. The rule confidence refers to the confidence of the initial matching rule that meets the antecedent conditions itself. It is the weighting basis for weighted fusion of the antecedent matching rate and the consequent conformity when calculating the correlation matching degree. The consequent conformity is a quantitative indicator that measures the degree of conformity between the real-time gateway energy consumption data and the expected value of the consequent of the rule that meets the antecedent conditions, calculated based on the consequent deviation rate. The consequent conformity is calculated by subtracting the average consequent deviation rate from 1.

[0044] This invention ensures that real-time data analysis is not limited to a single moment by comparing the antecedent conditions of rules with real-time data. Instead, by comparing with defined rule premises, it enables more accurate identification of trends in the time series. This comparison reduces errors from single-point data analysis, avoids misjudgments caused by fluctuations in data at a single time point, and ensures the accuracy of anomaly identification. By filtering out rules that match the actual data, computational complexity is significantly reduced, eliminating the need for comprehensive testing of all rules and improving the system's real-time response speed. The antecedent matching rate provides a direct quantification of the matching effect of association rules, helping users better understand and adjust the sensitivity of matching rules. The consequent deviation rate reveals the degree of deviation between the actual data and the rule's expectations, providing a more accurate basis for identifying and diagnosing potential anomalies. Through the evaluation of consequent deviation... It can adjust the matching strategy in a timely manner, thereby improving the accuracy of rule prediction. Compared with the single data difference comparison method commonly used in existing technologies, it adds more dynamic adjustment and accurate identification capabilities. The introduction of the average consequent deviation rate can reduce the impact of individual abnormal data points on the overall analysis results, making the overall identification process more stable and reliable, thereby improving the overall anomaly identification capability. By integrating the confidence of multiple rules, the reliability of the rules can be evaluated more accurately, thus avoiding misjudgments caused by low confidence of a single rule when identifying abnormal behavior. By combining multiple factors to calculate the correlation matching degree, data and judgments from different dimensions can be effectively integrated, avoiding the one-sidedness of single-dimensional evaluation. The final correlation matching degree can comprehensively reflect the effect and accuracy of rule matching, ensuring that no potential problem points are missed in the anomaly identification process, and improving the overall identification and prediction capabilities of the system.

[0045] In one embodiment, step S5, which involves obtaining the corresponding data difference and sequence similarity based on each of the real-time gateway energy consumption data sequences and historical gateway data sequences, includes: S51. Extract the real-time parameter value and historical parameter value corresponding to each timestamp in each real-time gateway power consumption data sequence and historical gateway data sequence, and obtain the absolute difference of the corresponding parameter based on the difference between each real-time parameter value and historical parameter value; S52. Obtain the corresponding average absolute difference based on the multiple absolute differences of the parameters, and perform a weighted summation based on the multiple average absolute differences to obtain the weighted average absolute difference. S53. Obtain the relative difference of the corresponding parameter based on the ratio of the absolute difference of each parameter to the historical parameter value, and obtain the corresponding average relative difference based on multiple relative differences of the parameters; S54. A weighted sum is performed on multiple average relative differences to obtain a weighted average relative difference, and a weighted sum is performed on the weighted average relative difference and the weighted average absolute difference to obtain the data difference degree. S55. Construct a sequence alignment matrix using the real-time gateway energy consumption data sequence as the query sequence and the historical gateway data sequence as the reference sequence, and obtain the Euclidean distance between each data point of the real-time gateway energy consumption data sequence and the historical gateway data sequence according to the sequence alignment matrix. S56. Normalize each Euclidean distance to obtain the corresponding standardized Euclidean distance, and obtain the average Euclidean distance based on the multiple standardized Euclidean distances. S57. The Pearson correlation coefficient algorithm is used to obtain the linear correlation coefficient between the real-time gateway energy consumption data sequence and the historical gateway data sequence, and the sequence similarity is calculated based on the linear correlation coefficient and the average Euclidean distance, wherein the calculation formula is: ; Where A represents sequence similarity, α represents the weight of the linear correlation coefficient, a represents the linear correlation coefficient, β represents the weight of the average Euclidean distance, and b represents the average Euclidean distance.

[0046] As described in steps S51-S57 above, this invention provides foundational data for subsequent abnormal behavior identification by extracting the parameter value differences at each timestamp in real-time and historical data. Compared to existing technologies that may only focus on overall trends or data at a single point in time, this invention provides a more refined observation and judgment capability through hourly comparison. The data comparison at each time point reveals the differences between real-time and historical behavior, enabling the system to accurately capture changes within a small range. This precision improves the ability to identify abnormal behavior, especially in time series where there are complex fluctuations or periodic changes, allowing for earlier detection of potential abnormal trends. By calculating the average absolute difference of multiple parameters, the differences between multiple data points can be more comprehensively evaluated, rather than just the differences of a single data point. By calculating relative differences, the method can focus more on proportional changes between data points rather than absolute value differences. For data analysis, the system is more sensitive to relative changes. For example, the absolute value of some parameters may be large, but their changes may be relatively small. The relative difference can help determine whether the change is within the expected range. By weighted summing of the relative and absolute differences, the system combines the two to further improve the measurement of data differences. In real-world applications, different scenarios may require different levels of importance to relative and absolute changes based on actual needs. For example, in some abnormal energy consumption scenarios, the change in absolute difference may be more critical, while in other scenarios, the relative difference may better reflect the trend of energy consumption changes. Through the weighted summation method, the system can flexibly adjust the influence of the two according to different scenarios, enhancing the adaptability and accuracy of data difference assessment.

[0047] Understandably, by constructing a sequence alignment matrix, the comparison between real-time and historical data sequences is not limited to a single point in time, but comprehensively considers the changing trends of the entire time series. Euclidean distance, as a classic method for measuring data similarity, can quantify the differences between each data point, thus laying the foundation for subsequent similarity assessment. By aligning and comparing the entire sequence, the local errors caused by judging data at only a certain moment are avoided, making the comparison results more stable and accurate. Especially when the time series has obvious periodicity or fluctuation, it can effectively identify potential abnormal changes. Normalization can eliminate the influence of data scale, making data of different dimensions and units comparable when calculating similarity. By calculating the average Euclidean distance, the similarity of the entire data sequence can be further quantified, thus providing a clear and accurate quantitative basis for anomaly detection. Pearson correlation coefficient can measure the linear relationship between two time series, helping to judge the correlation between data sequences. By combining linear correlation and Euclidean distance, the system can comprehensively consider the local changes and overall correlation of the data sequence, making the similarity calculation more comprehensive and multi-dimensional, reducing the possibility of misjudgment and omission.

[0048] like Figure 2 As shown, this application also provides a rapid identification system for abnormal energy consumption behavior based on gateway data association rule mining, including: The mining module acquires multi-dimensional gateway data and historical time-series data of multiple energy-consuming nodes within the gateway's coverage area, and performs time-series association rule mining on the historical time-series data of multiple gateways to obtain a set of time-series association rules; The matching module is used to obtain the real-time gateway energy consumption data and real-time scenario information of each energy-consuming node, and to match the corresponding target association rule subset from the association rule library according to each real-time scenario information. The first acquisition module is used to acquire the association matching degree based on each real-time gateway energy consumption data and the target association rule subset, and to determine whether the association matching degree is less than a preset matching threshold. If the correlation matching degree is less than the preset matching threshold, it is initially determined that the energy-consuming node has an abnormal energy consumption risk, and the real-time gateway energy consumption data sequence of the energy-consuming node within the preset time window and the historical gateway data sequence of the corresponding scenario in the correlation rule base are obtained. The second acquisition module is used to acquire corresponding data difference and sequence similarity based on each real-time gateway energy consumption data sequence and historical gateway data sequence, and to acquire corresponding anomaly comprehensive score based on each data difference and sequence similarity. The judgment module is used to determine whether the comprehensive anomaly score is less than a preset anomaly threshold; If the comprehensive score of the anomaly is less than the preset anomaly threshold, then it is finally determined that the energy-consuming node has abnormal energy consumption behavior; If the abnormal comprehensive score is not less than the preset matching threshold, the energy consumption node is determined to be normal.

[0049] In one embodiment, the first acquisition module includes: The first acquisition unit is used to acquire the rule antecedent conditions and rule consequent expected values ​​of each preliminary matching rule in the target associated rule subset, and to determine whether the real-time gateway energy consumption data meets the rule antecedent conditions. If the real-time gateway energy consumption data meets the rule antecedent conditions, then the preliminary matching rule corresponding to the rule antecedent conditions is marked as an associated matching antecedent rule; The second acquisition unit is used to acquire the antecedent matching rate based on the ratio of the number of associated matching antecedent rules to the number of initially matched rules in the target associated rule subset; The third acquisition unit is used to obtain the corresponding successor deviation rate based on the real-time gateway energy consumption data and the expected value of the rule successor of each associated matching antecedent rule, and to obtain the average successor deviation rate based on multiple successor deviation rates. The fourth acquisition unit is used to acquire the rule confidence of each associated matching antecedent rule, and to acquire the average confidence based on the multiple rule confidences; The fifth acquisition unit is used to acquire the consequent fit degree based on the average consequent deviation rate, and to acquire the correlation fit degree based on the consequent fit degree, the average confidence degree and the antecedent matching rate.

[0050] It should be noted that each module and unit in the system for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining corresponds one-to-one with the steps in the method for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining.

[0051] like Figure 3 As shown, this application also provides a computer device, which can be a server, and its internal structure can be as follows: Figure 3As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores all the data required for the process of a method for rapidly identifying abnormal energy consumption behavior based on gateway data association rule mining. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements the method for rapidly identifying abnormal energy consumption behavior based on gateway data association rule mining.

[0052] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer equipment on which the present application is applied.

[0053] An embodiment of this application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements any of the above-described methods for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining.

[0054] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in this application and in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-speed SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0055] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, apparatus, article, or method. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0056] The above description is merely a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining, characterized in that, include: Obtain multi-dimensional gateway data and historical time-series data of multiple energy-consuming nodes within the gateway coverage area, and perform time-series association rule mining on the historical time-series data of multiple gateways to obtain a time-series association rule set; Multi-dimensional data association rule mining is performed on multiple multi-dimensional gateway data to obtain a multi-dimensional data association rule set, and an association rule library is constructed based on the multi-dimensional data association rule set and the time series association rule set; Obtain real-time gateway energy consumption data and real-time scenario information for each energy-consuming node, and match the corresponding target association rule subset from the association rule library based on each real-time scenario information; The association matching degree is obtained based on the energy consumption data of each real-time gateway and the subset of target association rules, and it is determined whether the association matching degree is less than a preset matching threshold. If the correlation matching degree is less than the preset matching threshold, it is initially determined that the energy-consuming node has an abnormal energy consumption risk, and the real-time gateway energy consumption data sequence of the energy-consuming node within the preset time window and the historical gateway data sequence of the corresponding scenario in the correlation rule base are obtained. Extract the real-time parameter value and historical parameter value corresponding to each timestamp in each of the real-time gateway energy consumption data sequences and historical gateway data sequences, and obtain the absolute difference of the corresponding parameter based on each of the real-time parameter value and historical parameter value; The corresponding average absolute difference is obtained based on the absolute difference of multiple parameters, and the weighted sum is obtained by weighting the multiple average absolute differences. The relative difference of each parameter is obtained based on the absolute difference of each parameter and the historical parameter value, and the corresponding average relative difference is obtained based on multiple relative differences of the parameters. The weighted average relative difference is obtained by weighted summation of multiple average relative differences, and the data difference degree is obtained based on the weighted average relative difference and the weighted average absolute difference. A sequence alignment matrix is ​​constructed using the real-time gateway energy consumption data sequence as the query sequence and the historical gateway data sequence as the reference sequence. The Euclidean distance between each data point of the real-time gateway energy consumption data sequence and the historical gateway data sequence is obtained based on the sequence alignment matrix. Each Euclidean distance is normalized to obtain the corresponding standardized Euclidean distance, and the average Euclidean distance is obtained based on the multiple standardized Euclidean distances. The Pearson correlation coefficient algorithm is used to obtain the linear correlation coefficient between the real-time gateway energy consumption data sequence and the historical gateway data sequence. The sequence similarity is obtained based on the linear correlation coefficient and the mean Euclidean distance. The corresponding anomaly comprehensive score is obtained based on each data difference and sequence similarity. Determine whether the overall anomaly score is less than a preset anomaly threshold; If the comprehensive score of the anomaly is less than the preset anomaly threshold, then it is finally determined that the energy-consuming node has abnormal energy consumption behavior; If the abnormal comprehensive score is not less than the preset matching threshold, the energy consumption node is determined to be normal.

2. The method for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining according to claim 1, characterized in that, The step of mining time series association rules from the historical time series data of multiple gateways to obtain a time series association rule set includes: Obtain the timestamp field and the corresponding energy consumption parameter data from the historical time series data of each gateway, and sort the multiple energy consumption parameter data according to the chronological order of each timestamp field to obtain an ordered time series dataset; Obtain the time span and data density of the ordered time series dataset, and determine the time window size based on the time span and data density of the ordered time series dataset; The ordered time series dataset is divided into multiple sub-time series according to the time window size, and the stationarity of all the sub-time series is tested to obtain multiple non-stationary sub-time series and stationary sub-time series. Each non-stationary sub-time series is differentially processed to obtain the corresponding stationary sub-time series, and the time features of each stationary sub-time series are extracted using the sliding window method. A time series feature vector is constructed based on multiple time features, and a priori algorithm is used to mine the correlation between the time series feature vector and the parameter data in the time dimension, so as to obtain a time series association rule set.

3. The method for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining according to claim 1, characterized in that, The step of performing multi-dimensional data association rule mining on multiple multi-dimensional gateway data to obtain a multi-dimensional data association rule set, and constructing an association rule base based on the multi-dimensional data association rule set and the time series association rule set, includes: Obtain multi-dimensional attribute data for each of the multi-dimensional gateway data, wherein the multi-dimensional attribute data includes continuous attribute data and discrete attribute data; Obtain the numerical range and data distribution characteristics of the continuous attribute data, and determine the discretization interval division criteria based on the numerical range and data distribution characteristics; According to the discretization interval division standard, each continuous attribute data is divided into discrete intervals to obtain the corresponding discretized continuous attribute data, and a unique code identifier is assigned to each of the discretized continuous attribute data and discrete attribute data. The corresponding discrete continuous attribute data and the original discrete attribute data are encoded according to each unique coding identifier to obtain a coded multidimensional dataset; A transaction matrix is ​​constructed based on the coded multidimensional dataset, and a frequent itemset mining is performed on the transaction matrix using a frequent pattern growth algorithm to obtain a multidimensional data association rule set. The time series association rule set and the multi-dimensional data association rule set are normalized and standardized, and the processed time series association rule set and multi-dimensional data association rule set are integrated and stored to obtain the association rule library.

4. The method for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining according to claim 1, characterized in that, The step of matching the corresponding target association rule subset from the association rule base based on each of the real-time scene information includes: Extract key scene dimensions from the real-time scene information, and determine key fields for scene matching based on the key scene dimensions; From the association rule base, candidate association rule sets associated with the key fields of the scenario matching are selected, and the number of overlaps and matching accuracy between the applicable scenario tags and key scenario dimensions of each candidate rule in the candidate association rule set are obtained. Based on each number of overlaps and matching accuracy, obtain the corresponding scene matching score, and determine whether the scene matching score is less than the score threshold; If the scene matching score is not less than the score threshold, then the candidate rule corresponding to the scene matching score is marked as a preliminary matching rule; Obtain the support and confidence of each preliminary matching rule, and obtain the corresponding comprehensive priority score based on each support and confidence. The preliminary matching rules are sorted from high to low according to the comprehensive priority score, and a preset number of preliminary matching rules at the top of the sort are selected to obtain a subset of target association rules.

5. The method for rapid identification of abnormal energy consumption behavior based on gateway data association rule mining according to claim 1, characterized in that, The step of obtaining the association matching degree based on each of the real-time gateway energy consumption data and the target association rule subset includes: Obtain the rule antecedent conditions and rule consequent expected values ​​for each preliminary matching rule in the target association rule subset, and determine whether the real-time gateway energy consumption data meets the rule antecedent conditions; If the real-time gateway energy consumption data meets the rule antecedent conditions, then the preliminary matching rule corresponding to the rule antecedent conditions is marked as an associated matching antecedent rule; The antecedent matching rate is obtained by the ratio of the number of antecedent rules in the associated matching to the number of initially matched rules in the target associated rule subset; The corresponding successor deviation rate is obtained based on the real-time gateway energy consumption data and the expected value of the successor of each associated matching predecessor rule, and the average successor deviation rate is obtained based on multiple successor deviation rates. Obtain the rule confidence of each associated matching antecedent rule, and obtain the average confidence based on the multiple rule confidences; The consequent fit is obtained based on the average consequent deviation rate, and the correlation fit is obtained based on the consequent fit, average confidence level, and antecedent matching rate.

6. A rapid identification system for abnormal energy consumption behavior based on gateway data association rule mining, characterized in that, include: The mining module acquires multi-dimensional gateway data and historical time-series data of multiple energy-consuming nodes within the gateway's coverage area, and performs time-series association rule mining on the historical time-series data of multiple gateways to obtain a time-series association rule set; The module is used to mine multi-dimensional data association rules from multiple multi-dimensional gateway data to obtain a multi-dimensional data association rule set, and to build an association rule library based on the multi-dimensional data association rule set and the time series association rule set. The matching module is used to obtain the real-time gateway energy consumption data and real-time scenario information of each energy-consuming node, and to match the corresponding target association rule subset from the association rule library according to each real-time scenario information. The first acquisition module is used to acquire the association matching degree based on each real-time gateway energy consumption data and the target association rule subset, and to determine whether the association matching degree is less than a preset matching threshold. If the correlation matching degree is less than the preset matching threshold, it is initially determined that the energy-consuming node has an abnormal energy consumption risk, and the real-time gateway energy consumption data sequence of the energy-consuming node within the preset time window and the historical gateway data sequence of the corresponding scenario in the correlation rule base are obtained. The second acquisition module is used to extract the real-time parameter value and historical parameter value corresponding to each timestamp in each of the real-time gateway energy consumption data sequence and the historical gateway data sequence, and to obtain the absolute difference of the corresponding parameter based on each of the real-time parameter value and the historical parameter value. The corresponding average absolute difference is obtained based on the absolute difference of multiple parameters, and the weighted sum is obtained by weighting the multiple average absolute differences. The relative difference of each parameter is obtained based on the absolute difference of each parameter and the historical parameter value, and the corresponding average relative difference is obtained based on multiple relative differences of the parameters. The weighted average relative difference is obtained by weighted summation of multiple average relative differences, and the data difference degree is obtained based on the weighted average relative difference and the weighted average absolute difference. A sequence alignment matrix is ​​constructed using the real-time gateway energy consumption data sequence as the query sequence and the historical gateway data sequence as the reference sequence. The Euclidean distance between each data point of the real-time gateway energy consumption data sequence and the historical gateway data sequence is obtained based on the sequence alignment matrix. Each Euclidean distance is normalized to obtain the corresponding standardized Euclidean distance, and the average Euclidean distance is obtained based on the multiple standardized Euclidean distances. The Pearson correlation coefficient algorithm is used to obtain the linear correlation coefficient between the real-time gateway energy consumption data sequence and the historical gateway data sequence. The sequence similarity is obtained based on the linear correlation coefficient and the mean Euclidean distance. The corresponding anomaly comprehensive score is obtained based on each data difference and sequence similarity. The judgment module is used to determine whether the comprehensive anomaly score is less than a preset anomaly threshold; If the comprehensive score of the anomaly is less than the preset anomaly threshold, then it is finally determined that the energy-consuming node has abnormal energy consumption behavior; If the abnormal comprehensive score is not less than the preset matching threshold, the energy consumption node is determined to be normal.

7. The rapid identification system for abnormal energy consumption behavior based on gateway data association rule mining according to claim 6, characterized in that, The first acquisition module includes: The first acquisition unit is used to acquire the rule antecedent conditions and rule consequent expected values ​​of each preliminary matching rule in the target associated rule subset, and to determine whether the real-time gateway energy consumption data meets the rule antecedent conditions. If the real-time gateway energy consumption data meets the rule antecedent conditions, then the preliminary matching rule corresponding to the rule antecedent conditions is marked as an associated matching antecedent rule; The second acquisition unit is used to acquire the antecedent matching rate based on the ratio of the number of associated matching antecedent rules to the number of initially matched rules in the target associated rule subset; The third acquisition unit is used to obtain the corresponding successor deviation rate based on the real-time gateway energy consumption data and the expected value of the rule successor of each associated matching antecedent rule, and to obtain the average successor deviation rate based on multiple successor deviation rates. The fourth acquisition unit is used to acquire the rule confidence of each associated matching antecedent rule, and to acquire the average confidence based on the multiple rule confidences; The fifth acquisition unit is used to acquire the consequent fit degree based on the average consequent deviation rate, and to acquire the correlation fit degree based on the consequent fit degree, the average confidence degree and the antecedent matching rate.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images