Special variable user electricity abnormal chain construction method fusing deep learning

Abstract

The present application relates to the technical field of user electricity chain analysis, and discloses a special transformer user electricity abnormal chain construction method fused with deep learning, which comprises collecting time sequence electricity data and power grid topology data of special transformer users, taking each special transformer user as a node, constructing a graph structure containing physical connection edges and behavior association edges, inputting the constructed graph structure into a space-time graph neural network model, introducing power grid physical constraint conditions into an optimization target, embedding power grid operation rules into the model as constraints, outputting multi-level abnormality detection results at the node level, edge level and subgraph level, constructing a heterogeneous graph containing user nodes, abnormal type nodes and time slice nodes through the multi-level abnormality detection results, searching for a path in the heterogeneous graph through a pre-defined association mode template, generating a candidate abnormal chain, and verifying the causal strength of the candidate abnormal chain through a time sequence causal relationship verification model, so that intelligent analysis of user electricity abnormal chains is realized.

Description

Technical Field

[0001] This invention relates to the technical field of user power consumption chain analysis, and discloses a method for constructing abnormal power consumption chains for dedicated transformer users by integrating deep learning. Background Technology

[0002] With the rapid development of smart grids, the electricity consumption behavior of dedicated transformer users is becoming increasingly complex. Abnormal electricity consumption causes significant economic losses to power supply companies. Current technologies still have many shortcomings. For example, methods such as setting abnormality thresholds, calculating power imbalance rates, or using outlier detection algorithms can only determine whether a user is abnormal, but cannot reveal the propagation path and causal relationships of abnormalities among user groups. They are mostly static analyses, lacking characterization of the dynamic evolution process of abnormalities. They cannot answer key questions such as where the abnormality originates, how it develops, and which users are affected, making it difficult for maintenance personnel to locate the root cause and take effective measures. Although some research has attempted to introduce deep learning models, these models are mostly black boxes, lacking reasonable explanations for their decision-making processes, and are difficult to directly support accurate on-site verification and evidence collection. Summary of the Invention

[0003] To address the aforementioned technical problems, the main objective of this invention is to provide a method for constructing anomaly chains for dedicated transformer users' power consumption by incorporating deep learning. This method includes:

[0004] S1. Collect time-series electricity consumption data and power grid topology data of dedicated transformer users, and construct a graph structure containing physical connection edges and behavioral association edges, with each dedicated transformer user as a node;

[0005] S2. Input the constructed graph structure into the spatiotemporal graph neural network model, extract spatiotemporal features, introduce power grid physical constraints into the optimization objective, embed the power grid operation law as a constraint into the model, and output multi-level anomaly detection results at the node level, edge level and subgraph level.

[0006] S3. Construct a heterogeneous graph containing user nodes, anomaly type nodes, and time slice nodes based on the multi-level anomaly detection results. Perform path search in the heterogeneous graph using a predefined association pattern template to generate candidate anomaly chains. Use a time-series causal relationship verification model to verify the causal strength of the candidate anomaly chains and output a high-confidence power consumption anomaly chain. The power consumption anomaly chain is used to characterize the origin, propagation path, and evolution process of the abnormal event.

[0007] As a preferred embodiment of the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention:

[0008] The method for constructing a graph structure containing physical connection edges and behavioral association edges includes:

[0009] S101. Collect the electrical connection relationships between dedicated transformer users recorded in the power grid geographic information system, and generate the physical connection edges through the electrical connection relationships to represent the inherent physical power grid links between users;

[0010] S102. Synchronously collect the time-series electricity consumption data of each special transformer user, and calculate the similarity measure of the electricity consumption data curve shape between any two users within a set time window.

[0011] S103. Set a similarity threshold. If the similarity metric exceeds the threshold, create a behavior association edge between the two user nodes to construct a dynamic association network that reflects the similarity of user electricity consumption behavior.

[0012] The physical connection edges and behavioral association edges constitute a graph structure that shows the relationship between the special transformer user group in both physical and behavioral dimensions.

[0013] As a preferred embodiment of the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention:

[0014] The physical connection edges are determined by the power grid topology;

[0015] The behavioral association edges are dynamically generated by analyzing the morphological similarity between user electricity consumption data curves.

[0016] As a preferred embodiment of the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention:

[0017] The spatiotemporal graph neural network model is composed of multiple spatiotemporal blocks connected in series. The graph structure is a multimodal graph structure, including a node feature matrix and an adjacency matrix. The node feature matrix is ​​composed of the time-series electricity consumption data of the dedicated transformer user collected.

[0018] Each of the spatiotemporal blocks contains a graph convolutional layer and a temporal convolutional layer;

[0019] The node feature matrix and the adjacency matrix defined by physical connection edges and behavioral association edges in the multimodal graph structure are used as inputs to the spatiotemporal graph neural network model.

[0020] As a preferred embodiment of the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention:

[0021] In the spatiotemporal block, spatial information is aggregated along the connection relationship defined by the adjacency matrix through the graph convolutional layer to capture the local spatial neighborhood features of each node in the graph;

[0022] The aggregated local spatial neighborhood features are input into the temporal convolutional layer, which captures the dynamic evolution of each node in the time dimension by performing a one-dimensional convolution operation in the time dimension.

[0023] The node embedding representation obtained after processing through multiple spatiotemporal blocks is used as the final extracted spatiotemporal feature that integrates spatial dependence and temporal evolution.

[0024] As a preferred embodiment of the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention:

[0025] The optimization objective is composed of both task loss and physical constraint loss;

[0026] The physical constraint loss is designed based on Kirchhoff's current law and is constructed by calculating the difference between the sum of the power data of the parent node and the child node in the time-series power consumption data in the graph structure.

[0027] The spatiotemporal features are input into three parallel fully connected layers and activation functions, respectively, to generate anomaly detection results at three levels.

[0028] As a preferred embodiment of the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention:

[0029] Based on the user nodes in the multi-level anomaly detection results, create anomaly type nodes and time slice nodes:

[0030] The abnormal type node is defined by the abnormal category in the node-level, edge-level, and subgraph-level anomaly detection results;

[0031] Time slice nodes are defined by discretizing the time interval after the timestamp of the anomaly occurs;

[0032] The relationships recorded in the anomaly detection results are used to establish connection edges between user nodes, anomaly type nodes, and time slice nodes, constructing a heterogeneous graph containing multiple node types and relationship types.

[0033] As a preferred embodiment of the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention:

[0034] Two association pattern templates are predefined, which specify the sequence of node and edge types that are allowed to roam in a heterogeneous graph, including a propagation template and an evolution template;

[0035] The propagation template is defined as a sequence of user nodes, exception type nodes, and user nodes, used to search for the propagation path of exceptions among users;

[0036] An evolution template is defined as a sequence of user nodes, exception type nodes, time slice nodes, exception type nodes, and user nodes, used to search for the evolution path of the same user exception over time.

[0037] By restarting the random walk to search for paths in the heterogeneous graph, paths with a walk probability exceeding a preset threshold are instantiated as candidate abnormal chains.

[0038] As a preferred embodiment of the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention:

[0039] Extract the original time-series power consumption data corresponding to adjacent node pairs in each candidate anomaly chain;

[0040] The time-series electricity consumption data is input into the causal relationship verification model. After excluding the influence of other variables, statistical hypothesis testing is used to determine whether each time series has predictive power for another time series.

[0041] Calculate the causal strength score for each candidate anomaly chain, which is determined by a causal relationship between all adjacent node pairs in the anomaly chain.

[0042] As a preferred embodiment of the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention:

[0043] Set a causal strength threshold, and filter out candidate abnormal chains whose causal strength scores exceed the threshold as high-confidence power consumption abnormal chains;

[0044] The power consumption anomaly chain is output in a directed graph structure, where nodes represent the user, anomaly type, and time of the anomaly, and edges represent verified causal relationships. The directed graph represents the entire chain of information on the evolution of the anomaly event from its origin to its propagation path.

[0045] The beneficial effects of this invention are:

[0046] This application constructs a graph structure containing physical connection edges and behavioral association edges, and builds a heterogeneous graph based on multi-level anomaly detection results. This allows for the systematic revelation of the propagation path and evolution process of anomalies among user groups, forming a complete anomaly chain.

[0047] This application embeds the physical constraints of the power grid into the optimization objective of the spatiotemporal graph neural network model, enabling the deep learning model to learn data features and follow the operation rules of the power grid during the training process. This significantly reduces the false alarm rate, ensures that the detection results conform to both the data distribution and physical feasibility, and improves the credibility and practicality of the anomaly detection results.

[0048] This application outputs multi-level anomaly detection results at the node, edge, and subgraph levels, enabling comprehensive perception from three dimensions: individual anomalies, propagation anomalies, and regional collaborative anomalies.

[0049] This application uses a predefined association pattern template for path search and employs a temporal causal relationship verification model for causal strength verification, which can effectively distinguish between real causal anomaly chains and accidental temporal associations.

[0050] The final output of this application clearly characterizes the origin, propagation path and evolution process of abnormal events, transforming complex abnormal patterns into an intuitive directed graph structure, which significantly improves the accuracy and efficiency of abnormal handling. Attached Figure Description

[0051] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0052] Figure 1 This is a flowchart of the method for constructing anomaly chains for dedicated transformer users that integrates deep learning, as described in this invention.

[0053] Figure 2 This is a flowchart of the anomaly detection model for the method of constructing anomaly chains for dedicated transformer users that integrates deep learning, as described in this invention.

[0054] Figure 3 This is a flowchart of the anomaly chain construction process in the method for constructing anomaly chains for dedicated transformer users that integrates deep learning, as described in this invention.

[0055] Figure 4 This is a flowchart illustrating the causal relationship verification process in the method for constructing abnormal power consumption chains for dedicated transformer users that integrates deep learning, as described in this invention. Detailed Implementation

[0056] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0057] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0058] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0059] Example 1:

[0060] like Figure 1 As shown, the method for constructing abnormal power consumption chains for dedicated transformer users by integrating deep learning includes:

[0061] like Figure 2 As shown, S1 collects time-series electricity consumption data and power grid topology data of dedicated transformer users, and constructs a graph structure containing physical connection edges and behavioral association edges, with each dedicated transformer user as a node.

[0062] The method for constructing a graph structure containing physical connection edges and behavioral association edges includes:

[0063] S101. Collect the electrical connection relationships between dedicated transformer users recorded in the power grid geographic information system, and generate the physical connection edges through the electrical connection relationships to represent the inherent physical power grid links between users;

[0064] Specifically, physical connection edges are used to represent the inherent connection relationships between dedicated transformer users based on the actual grid architecture.

[0065] The physical connection edge data foundation can be derived from the core business system of the power grid, including geographic information systems and data acquisition and monitoring control systems, which record the electrical connection topology between substations, lines, switches and dedicated transformer users.

[0066] Furthermore, by analyzing the electrical connection topology, key information such as whether any two dedicated transformer users are powered through the same line and whether there is an upstream or downstream power supply relationship can be obtained. If there is a direct electrical connection between two user nodes, that is, a physical connection edge is established between the two users, the physical connection edge constitutes a channel for the anomaly to propagate along the physical path.

[0067] S102. Synchronously collect the time-series electricity consumption data of each special transformer user, and calculate the similarity measure of the electricity consumption data curve shape between any two users within a set time window.

[0068] The calculation of the similarity metric value of the electricity consumption data curves adopts a multi-dimensional feature fusion analysis method:

[0069] In the dimension of fluctuation trend analysis, the similarity of macro-level electricity consumption patterns is assessed by comparing the degree of consistency in the direction of curve changes;

[0070] In the time sequence dimension of key events, the degree of synchronization of electricity consumption behavior is assessed by matching the occurrence time correspondence between peak and valley electricity consumption.

[0071] In terms of cyclical patterns, the inherent consistency of users' electricity consumption habits can be assessed by analyzing the cyclical patterns contained in the electricity consumption curves.

[0072] The analysis results from the above three dimensions are combined using specific fusion rules to form the final quantitative similarity metric.

[0073] Specifically, while constructing the physical connection edge, the system collects time-series power consumption data of each dedicated transformer user, including but not limited to current, voltage, active power and reactive power data.

[0074] The similarity metric of the electricity consumption data curves between any two dedicated transformer user nodes within a set time window is calculated using time-series electricity consumption data. Specifically, the calculation process analyzes the fluctuation trend, peak timing, and periodic pattern characteristics of the two time-series data curves, comprehensively evaluates their morphological similarity, and obtains a quantitative similarity metric.

[0075] In this application, a preferred method for calculating behavioral similarity measurement includes:

[0076] Behavioral similarity measurement calculation includes fluctuation trend similarity analysis, peak time series alignment analysis, periodic pattern consistency analysis, and comprehensive similarity measurement value calculation.

[0077] Specifically, fluctuation trend similarity is used to assess the consistency of two electricity consumption curves in terms of overall direction and magnitude of change.

[0078] Furthermore, the two time-series curves are segmented and linearized to transform the continuous curves into linear segments with slope and length.

[0079] Calculate the slope matching degree of the two curves in the corresponding time period to obtain the same direction of change, such as the proportional relationship between simultaneous increase or decrease and the magnitude of change.

[0080] A comprehensive fluctuation trend similarity score is obtained by weighted averaging of the matching degree of all line segments within the entire time window.

[0081] Specifically, peak timing alignment is used to quantify the degree of synchronization between two curves at the time of critical events, such as peak and off-peak electricity consumption.

[0082] Furthermore, a sliding window extremum detection algorithm is used to identify all local extrema points in the two curves.

[0083] For each extreme point identified on one curve, find the corresponding extreme point in the adjacent time region on another curve.

[0084] Calculate the time offset between the matched extreme point pairs.

[0085] Specifically, the periodic pattern consistency aims to discover similarities in underlying periodic patterns in electricity consumption curves.

[0086] Furthermore, time-frequency transformation is performed on the two time-series curves respectively, converting them from the time domain to the frequency domain. By analyzing the energy distribution in the frequency domain, characteristic frequency components representing the periodic mode are extracted.

[0087] Compare the similarity of the energy distribution of the two curves at these characteristic frequencies, and evaluate the phase relationship of their corresponding periodic components.

[0088] Specifically, the final quantitative similarity metric is obtained by weighted geometric mean of fluctuation trend similarity score, peak time series alignment score, and cycle pattern consistency score.

[0089] Furthermore, the weighted geometric mean ensures that low similarity in any dimension will significantly suppress the final result, ensuring that only electricity consumption behaviors that are highly similar across multiple dimensions are judged as highly similar. The resulting comprehensive similarity metric is a normalized value between 0 and 1; the higher the value, the more similar the shapes of the two electricity consumption curves.

[0090] S103. Set a similarity threshold. If the similarity metric exceeds the threshold, create a behavior association edge between the two user nodes to construct a dynamic association network that reflects the similarity of user electricity consumption behavior.

[0091] Specifically, the electricity consumption behavior of dedicated transformer users is constrained by inherent factors such as their industry attributes, production processes, and electricity consumption patterns. If the electricity consumption data curves of two dedicated transformer users show similarity within a set time window, such as daily electricity consumption cycles or weekly electricity consumption cycles, it indicates that there may be potential correlations between the two, such as industry collaborative production, shared power supply branches, or similar electricity consumption habits. Although there is no direct physical connection link to the power grid, such potential correlations may become hidden paths for the propagation of anomalies during the operation of the power grid.

[0092] The similarity judgment logic includes three core features: the fluctuation trend of electricity consumption data curves, peak time series, and periodic patterns. Specifically, the fluctuation trend reflects the consistency of the overall change direction and amplitude of user electricity load, the peak time series reflects the synchronicity of the occurrence of peak and trough times of user electricity consumption, and the periodic pattern reflects the regularity of matching user electricity consumption behavior. These three features together constitute the key semantic information of electricity consumption behavior, which can effectively filter randomly similar electricity consumption data and ensure that the behavioral correlation edges truly map the potential electricity consumption correlations between dedicated transformer users.

[0093] Specifically, after obtaining the behavioral similarity measurement value between users, a behavioral association edge is created by using a pre-set similarity threshold. When the similarity measurement value of any two dedicated transformer user nodes exceeds the similarity threshold, a behavioral association edge is established between the two nodes. The behavioral association edge constitutes a dynamic association network that reflects the similarity of users' electricity consumption behavior, which is used to capture potential associations that do not have a direct physical connection but have similar electricity consumption behavior patterns.

[0094] The physical connection edges and behavioral association edges together form a complete graph structure describing the relationship between the special transformer user group in the physical and behavioral dimensions.

[0095] By introducing behavioral association edges, the limitations of a single physical topology are overcome, enabling the discovery and characterization of potential, non-physical connections. These behavioral association edges are dynamically updated based on real-time electricity consumption data, allowing the graph structure to reflect changes in user electricity consumption patterns in a timely manner. The two-dimensional associations provide richer structural information for subsequent deep learning models, significantly improving the accuracy of anomaly detection and source tracing analysis.

[0096] The physical connection edges are determined by the power grid topology;

[0097] The behavioral association edges are dynamically generated by analyzing the morphological similarity between user electricity consumption data curves.

[0098] like Figure 2 As shown in step S2, the constructed graph structure is input into the spatiotemporal graph neural network model to extract spatiotemporal features. By introducing power grid physical constraints into the optimization objective, the power grid operation law is used as a constraint embedded model to output multi-level anomaly detection results at the node level, edge level, and subgraph level.

[0099] The spatiotemporal graph neural network model incorporates physical constraints of the power grid. Since the power grid operation follows Kirchhoff's current law, Kirchhoff's current law is transformed into a physical constraint loss term, which together with the anomaly detection task loss term of the spatiotemporal graph neural network model constitutes the overall optimization objective. During model training, the overall optimization objective drives the model to learn the spatiotemporal characteristics of the time-series electricity consumption data of dedicated transformer users to achieve the anomaly detection function, and forces the output results of the spatiotemporal graph neural network model to conform to Kirchhoff's current law, ensuring that the anomaly detection results are physically reasonable.

[0100] The spatiotemporal graph neural network model is composed of multiple spatiotemporal blocks connected in series. The graph structure is a multimodal graph structure, including a node feature matrix and an adjacency matrix. The node feature matrix is ​​composed of the time-series electricity consumption data of the dedicated transformer user collected.

[0101] Each of the spatiotemporal blocks contains a graph convolutional layer and a temporal convolutional layer;

[0102] The node feature matrix and the adjacency matrix defined by physical connection edges and behavioral association edges in the multimodal graph structure are used as inputs to the spatiotemporal graph neural network model.

[0103] Specifically, each row of the node feature matrix corresponds to a dedicated transformer user node. The row vector consists of time-series electricity consumption data collected by that user within a set time window. This electricity consumption data includes, but is not limited to, time-series observations of current, voltage, active power, and reactive power. The time-series observations are directly derived from the measurement data of the electricity consumption information acquisition system.

[0104] The adjacency matrix is ​​used to quantitatively describe the connection relationships and connection strengths between all nodes in a graph. The adjacency matrix is ​​defined by both physical connection edges and behavioral association edges.

[0105] Furthermore, the weights of physical connection edges are determined based on the actual electrical connection relationships in the power grid topology data; the weights of behavioral association edges are determined based on the similarity metric of the electricity consumption data curves calculated in step S102.

[0106] The spatiotemporal graph neural network model consists of an input layer and multiple cascaded spatiotemporal blocks. Each spatiotemporal block is a composite computational unit, specifically containing a graph convolutional layer and a temporal convolutional layer.

[0107] Specifically, graph convolutional layers are used for feature extraction from the spatial dimension.

[0108] Specifically, based on the connection relationship defined by the adjacency matrix, the feature information of each node and the feature information of its neighboring nodes are aggregated and transformed, so that each node can capture the electricity consumption pattern features in its local spatial neighborhood, thereby identifying abnormal patterns caused by spatial correlation.

[0109] Temporal convolutional layers are used for feature extraction from the time dimension.

[0110] Furthermore, the temporal convolutional layer receives the node features with fused spatial information output by the graph convolutional layer, performs one-dimensional convolution operation on the temporal sequence of each node, and scans the temporal data through a sliding window to capture the dynamic evolution and dependencies of each node's own electricity consumption behavior over time.

[0111] By modifying the optimization objective to incorporate the power grid operation law as a constraint into the model, a preferred optimization objective of the model consists of two parts: task loss and physical constraint loss.

[0112] The task loss is based on a standard loss function calculated using the predicted output of the spatiotemporal graph neural network model and the true label or reconstruction error.

[0113] The physical constraint loss is designed based on Kirchhoff's current law. Specifically, in the graph structure, for user node groups with parent-child electrical connections, the difference between the sum of the power data of the parent node and the sum of the power data of the child node is calculated, and the norm of the difference is used as the physical constraint loss term.

[0114] For example, by weighting and summing the task loss and physical constraint loss together as the overall optimization objective for model training, the spatiotemporal graph neural network model is forced to not only fit the data during the learning process but also follow the basic physical laws of the power grid, thereby improving the rationality and reliability of the output results of the spatiotemporal graph neural network model.

[0115] Furthermore, the final node and edge embeddings after processing through multiple spatiotemporal blocks are input into three independent and parallel fully connected layers and nonlinear activation functions, respectively, to simultaneously compute the anomaly detection results at the three levels:

[0116] The node-level anomaly score is output through the fully connected layer of the node as a scalar value, used to quantify the degree of anomaly in the power consumption behavior of each dedicated transformer user node.

[0117] The edge-level anomaly score is a scalar value output by the fully connected layer used for edges, used to quantify the strength of the anomalous patterns or anomalous interactions transmitted on each physical connection edge or behavioral association edge.

[0118] Subgraph-level anomaly scores are calculated by weighting and aggregating all node-level and edge-level anomaly scores in the graph, and then passing them through a dedicated fully connected layer. These scores are used to identify regional collaborative anomaly patterns that extend beyond a single node or edge.

[0119] By using a specific architecture that connects spatiotemporal blocks, we have achieved collaborative modeling of spatial dependence and temporal evolution, which has a stronger ability to represent power consumption anomalies. By designing a physical constraint loss based on Kirchhoff's laws, we have embedded prior knowledge into the model, which effectively solves the problem of potentially physically unreliable results that may be generated by a purely data-driven model, and improves the model's generalization ability and interpretability.

[0120] In the spatiotemporal block, spatial information is aggregated along the connection relationship defined by the adjacency matrix through the graph convolutional layer to capture the local spatial neighborhood features of each node in the graph;

[0121] The aggregated local spatial neighborhood features are input into the temporal convolutional layer, which captures the dynamic evolution of each node in the time dimension by performing a one-dimensional convolution operation in the time dimension.

[0122] The node embedding representation obtained after processing through multiple spatiotemporal blocks is used as the final extracted spatiotemporal feature that integrates spatial dependence and temporal evolution.

[0123] In the spatiotemporal graph neural network model, feature extraction is accomplished through multiple spatiotemporal blocks connected in series, each containing a specific feature processing flow:

[0124] like Figure 3 As shown, the specific implementation method for spatial information aggregation in the graph convolutional layer described in this application includes:

[0125] Specifically, a preferred spatial aggregation method includes: the feature aggregation range of each node is clearly defined by the adjacency matrix, which contains the connection relationships defined by physical connection edges and behavioral association edges; the graph convolutional layer weightedly combines the features of each target node and its directly adjacent neighbor nodes according to the connection weights described by the adjacency matrix; each node can obtain the electricity consumption pattern features in its spatial neighborhood and establish spatial association relationships between nodes; the spatial aggregation operation enables the spatiotemporal graph neural network model to identify spatial anomaly propagation patterns caused by electrical connections or behavioral similarities.

[0126] Specifically, after spatial feature aggregation, the obtained node features containing spatial information are input into a temporal convolutional layer for temporal dimension analysis:

[0127] Temporal convolutional layers extract temporal features by performing one-dimensional convolution operations on the temporal dimension of node features. By using learnable convolutional kernels to slide and scan along the time axis of each node's feature vector, the local temporal dependencies of electricity consumption data are captured.

[0128] Furthermore, the convolutional kernel learns the correlation weights between different time points during the sliding process, identifying short-term fluctuation patterns and long-term trend changes in electricity consumption behavior. This temporal processing enables the spatiotemporal graph neural network model to understand the dynamic evolution of electricity consumption behavior at each node, including periodic electricity consumption habits and sudden abnormal changes.

[0129] Furthermore, through the cascading processing of multiple spatiotemporal blocks, the node features undergo multi-level feature transformations:

[0130] The graph convolutional layer and temporal convolutional layer in each spatiotemporal block process the features sequentially, with the output of the previous spatiotemporal block serving as the input of the next spatiotemporal block.

[0131] In the above cascaded structure, the shallow spatiotemporal blocks mainly capture local spatiotemporal patterns, while the deep spatiotemporal blocks can learn complex spatiotemporal dependencies.

[0132] The node embedding representation obtained after processing all spatiotemporal blocks contains spatiotemporal semantic information extracted from the original data. This spatiotemporal semantic information integrates the correlation characteristics of the spatial dimension and the evolutionary rules of the temporal dimension.

[0133] Through collaborative analysis of spatial and temporal dimensions, the characteristics of electricity consumption behavior patterns were extracted. Spatial aggregation ensured the effective capture of abnormal propagation paths, temporal analysis guaranteed the accurate understanding of dynamic evolution laws, and multi-level processing enabled the model to understand abnormal patterns from different scales.

[0134] The optimization objective is composed of both task loss and physical constraint loss; the physical constraint loss is designed based on Kirchhoff's current law and is constructed by calculating the difference between the sum of the power data of the parent node and the child node in the time-series power consumption data in the graph structure.

[0135] The spatiotemporal features are input into three parallel fully connected layers and activation functions, respectively, to generate anomaly detection results at three levels.

[0136] The optimization objective during model training consists of two core parts:

[0137] The task loss function is calculated using prediction error and is constructed based on the difference between the anomaly score output by the model and the true anomaly label. This loss function ensures that the model can accurately learn the mapping relationship from input data to anomaly patterns and is a fundamental optimization direction for model training.

[0138] The physical constraint loss function is designed based on the physical laws of power grid operation, specifically implemented according to Kirchhoff's current law. The calculation process for this loss term is as follows: First, identify node groups with parent-child electrical connections in the graph structure. Then, extract the power data of these nodes at the same time, and calculate the difference between the sum of the power data of the parent node and the sum of the power data of the directly connected child nodes. The sum of the squares of these differences constitutes the physical constraint loss, the physical meaning of which is that the constraint model follows the fundamental laws of power grid power balance.

[0139] During model training, the task loss and physical constraint loss are weighted and summed according to preset weight coefficients to form the final overall optimization objective. This combined optimization method forces the model to comply with the basic physical laws of the power grid while learning data characteristics, thereby ensuring that the output results conform to both the data distribution and physical feasibility.

[0140] The spatiotemporal features extracted from multiple spatiotemporal blocks are input into three independent parallel computation branches, each corresponding to an anomaly detection level:

[0141] The node-level anomaly detection branch maps spatiotemporal features to anomaly scores for each dedicated transformer user node through a fully connected layer and a nonlinear activation function. These anomaly scores quantify the degree of anomaly in a single user's electricity consumption behavior and reflect the anomalies in the node's own characteristics.

[0142] The edge-level anomaly detection branch calculates anomaly scores for each edge in the graph through another fully connected layer and an activation function. These scores represent the strength of anomaly propagation between nodes and reflect anomaly patterns in the connectivity relationships.

[0143] Specifically, the anomaly score for each edge includes both physically connected edges and behaviorally related edges.

[0144] Furthermore, a preferred option.

[0145] The subgraph-level anomaly detection branch first performs pooling operations on the spatiotemporal features to aggregate the feature information of the entire subgraph region. It then calculates the region-level anomaly score through a fully connected layer. The calculated region-level anomaly score is used to identify collaborative anomaly patterns that extend beyond the range of a single node or edge.

[0146] A preferred implementation method for using the computational region-level anomaly score to identify collaborative anomaly patterns that extend beyond a single node or edge includes:

[0147] The subgraph-level anomaly detection branch divides the multimodal graph structure into multiple logical subgraph regions. Each region contains a set of spatially or functionally closely related dedicated user nodes. For each subgraph region, feature information is extracted from the spatiotemporal characteristics of all nodes in each subgraph region through a combination of max pooling and mean pooling operations. Max pooling is used to capture significant anomalous signals within the region, while mean pooling is used to reflect the overall anomaly level of the region.

[0148] Cooperative pattern recognition inputs aggregated regional features into a fully connected neural network, which learns the mapping relationship between regional features and cooperative anomaly patterns through multi-layer nonlinear transformations.

[0149] The final regional-level anomaly score of the anomaly scoring mechanism is normalized to a value between 0 and 1 by the sigmoid activation function. This score comprehensively reflects the following three dimensions of anomaly evidence: the degree of abnormal clustering of nodes in the region, the integrity of the propagation path of edge anomalies, and the degree of deviation of the overall power consumption pattern of the region from the historical normal pattern. Through this multi-dimensional evaluation mechanism, distributed and collaborative abnormal power consumption behavior can be effectively identified.

[0150] Specifically, the fully connected neural network can be implemented by combining existing neural network function encapsulations with the technical content disclosed in this application.

[0151] The outputs of the three branches together constitute the complete anomaly detection result.

[0152] It should be noted that those skilled in the art can combine common knowledge in the field and the technical content disclosed in this application to calculate the regional-level anomaly score through a fully connected layer based on the electricity consumption characteristics and the feature information of the entire subgraph region through reverse aggregation.

[0153] S3. Construct a heterogeneous graph containing user nodes, anomaly type nodes, and time slice nodes based on the multi-level anomaly detection results. Perform path search in the heterogeneous graph using a predefined association pattern template to generate candidate anomaly chains. Use a time-series causal relationship verification model to verify the causal strength of the candidate anomaly chains and output a high-confidence power consumption anomaly chain. The power consumption anomaly chain is used to characterize the origin, propagation path, and evolution process of the abnormal event.

[0154] Based on the user nodes in the multi-level anomaly detection results, create anomaly type nodes and time slice nodes:

[0155] The abnormal type node is defined by the abnormal category in the node-level, edge-level, and subgraph-level anomaly detection results;

[0156] Time slice nodes are defined by discretizing the time interval after the timestamp of the anomaly occurs;

[0157] The relationships recorded in the anomaly detection results are used to establish connection edges between user nodes, anomaly type nodes, and time slice nodes, constructing a heterogeneous graph containing multiple node types and relationship types.

[0158] In this application, a preferred implementation method for constructing a heterogeneous information network includes:

[0159] Based on the multi-level anomaly detection results, a heterogeneous graph structure containing three types of nodes is constructed:

[0160] Heterogeneous graphs must simultaneously carry the main identifier of an anomaly (user node), type identifier (anomaly type node), time identifier (time slice node), and the relationship between the three. Node-level, edge-level, and subgraph-level anomaly detection results define the attributes of various nodes and edges in the heterogeneous graph, respectively.

[0161] The specific mapping logic includes:

[0162] Node-level anomaly detection results directly define the anomaly attributes of user nodes, enabling user nodes to accurately identify the special transformer users with anomalies and the anomaly type of those users;

[0163] The edge-level anomaly detection results define the weight attribute of the edges between user nodes. The weight value reflects the possibility of anomalies propagating between user nodes, providing information on the strength of anomaly propagation associations for heterogeneous graphs.

[0164] Subgraph-level anomaly detection results help define the attributes of anomaly type nodes. For example, if multiple user nodes in a certain area experience overload anomalies simultaneously, the regional collaborative characteristics of the anomaly type nodes are strengthened, providing contextual information on anomaly types for heterogeneous graphs.

[0165] The node system is built upon the aforementioned user nodes, and two new types of semantic nodes are established as extensions:

[0166] Anomaly type nodes are defined by the anomaly categories determined in the node-level, edge-level, and subgraph-level anomaly detection results. Each node represents a specific anomaly mode, such as overload, voltage anomaly, harmonic pollution, etc.

[0167] The time slice node is formed by discretizing the timestamp of the anomaly and dividing it into time intervals of equal length, with each node representing a specific time period of the anomaly.

[0168] Edge relationships are established based on the specific associations recorded in the anomaly detection results, and connecting edges are established between the three types of nodes:

[0169] Establish an occurrence relationship edge between the user node and the exception type node to indicate that a certain exception occurred for the user at a specific time;

[0170] Establish a relation edge between the user node and the time slice node to identify the specific time period when the user's anomaly occurred;

[0171] Evolutionary relationship edges are established between nodes of different anomaly types to reflect the transformation rules between different anomaly types;

[0172] By constructing connecting edges between the three types of nodes, a heterogeneous graph structure containing rich semantic relationships is formed.

[0173] A preferred method for designing association pattern templates and generating candidate chains includes defining templates based on business logic for power grid anomaly propagation, and predefining two types of association pattern templates:

[0174] The spatial propagation template adopts a path pattern of user nodes, exception type nodes, and user nodes to explore the spatial propagation path of exceptions among users.

[0175] The time evolution template adopts a path pattern of user nodes, exception type nodes, time slice nodes, exception type nodes, and user nodes to track the evolution of exceptions over time.

[0176] Path search is based on template-driven path search performed during a restarted random walk in a heterogeneous graph:

[0177] Specifically, the heterogeneous graph includes three types of nodes: user nodes, anomaly type nodes, and time slice nodes. The propagation process of anomalies in the power grid, for example, the propagation of an anomaly from user node A to user node B, corresponds to the node jump sequence of user node, anomaly type node, and user node. The evolution process of an anomaly corresponds to the node jump sequence of user node, anomaly type node, time slice node, anomaly type node, and user node.

[0178] Furthermore, the restart random walk algorithm has the characteristic of performing state transitions according to node type and edge type preferences, which can accurately match the node jump logic in the anomaly propagation and evolution process.

[0179] Set specific walk rules and transition probabilities for each associated pattern template;

[0180] During the walk, path confidence is calculated based on the connection strength and semantic relationships between nodes;

[0181] Instantiate paths with confidence levels exceeding a preset threshold as candidate anomaly chains;

[0182] Through templated path search, a set of candidate anomaly chains with business significance is systematically generated.

[0183] Temporal causality verification uses a causal relationship verification model to evaluate the causal strength of candidate anomaly chains.

[0184] Extract the original time-series electricity consumption data of adjacent node pairs in the candidate anomaly chain, and eliminate the influence of interference variables such as overall power grid load fluctuations and weather factors to ensure the accuracy of data analysis;

[0185] The model is validated by temporal causality to determine whether the temporal data of preceding nodes have significant predictive power for the temporal data of subsequent nodes. If they have significant predictive power, it indicates that there is a real causal relationship between the two. If there is only temporal sequence but no predictive power, it is determined to be a random temporal relationship.

[0186] The causal strength of candidate anomaly chains is calculated based on the causal association verification results to ensure that the output anomaly chains have true causal logic.

[0187] For each candidate abnormal chain, extract the original time-series electricity consumption data corresponding to adjacent nodes in the chain to ensure data time alignment and integrity;

[0188] Using statistical hypothesis testing methods, and controlling for the influence of other variables, we examine the predictive power of preceding time series on subsequent time series.

[0189] Construct a vector autoregressive model that includes relevant variables;

[0190] Determine Granger causal relationships between variables through hypothesis testing;

[0191] Calculate the significance level and influence strength of the causal relationship;

[0192] The causal strength score of each candidate abnormal chain is calculated based on the test results. The causal strength score comprehensively considers the significance of the causal relationship between all adjacent node pairs in the chain.

[0193] Furthermore, a causal strength threshold is set, and candidate abnormal chains with causal strength scores exceeding the threshold are selected as high-confidence electricity consumption abnormal chains.

[0194] The final output of the anomaly chain is visualized in a directed graph structure, including nodes that identify the subject, type, and time attributes of the anomaly event; directed edges that represent verified causal relationships, with edge weights reflecting the strength of causality; and a complete presentation of the origin node of the anomaly event, key links in the propagation path, and the final scope of its impact.

[0195] By using a structured representation of anomaly chains, the entire process of an anomaly event, from its initial occurrence, through spatial propagation and temporal evolution, to its final impact, is clearly displayed. Through heterogeneous information network modeling and causal relationship verification, the process of detecting isolated anomalies and constructing anomaly chains is realized, which can accurately reveal the origin, propagation, and evolution patterns of anomaly events.

[0196] Two association pattern templates are predefined, which specify the sequence of node and edge types that are allowed to roam in a heterogeneous graph, including a propagation template and an evolution template;

[0197] The propagation template is defined as a sequence of user nodes, exception type nodes, and user nodes, used to search for the propagation path of exceptions among users;

[0198] An evolution template is defined as a sequence of user nodes, exception type nodes, time slice nodes, exception type nodes, and user nodes, used to search for the evolution path of the same user exception over time.

[0199] By restarting the random walk to search for paths in the heterogeneous graph, paths with a walk probability exceeding a preset threshold are instantiated as candidate abnormal chains.

[0200] In this application, a preferred propagation template example is: after the first user node experiences a certain type of anomaly, the anomaly propagates spatially to affect the second user node. The specific traversal rule in the heterogeneous graph is: starting from the user node, reaching the anomaly type node via the occurrence relationship edge, and then connecting to the affected user node via the influence relationship edge.

[0201] In this application, a preferred evolution template example is: the same user node undergoes a transformation process of anomaly type in the time dimension. The specific walking rules in the heterogeneous graph are: starting from the user node, reaching the first anomaly type node through the relationship edge, then connecting to the time slice node through the relationship edge, reaching the second anomaly type node through the evolution relationship edge, and finally returning to the original user node.

[0202] A restarted random walk algorithm is used to perform template-driven path discovery in the heterogeneous graph, specifically as follows:

[0203] The initialization process sets a specific starting node distribution and transition probability matrix for each associated pattern template. The starting probability is allocated based on the importance of the node in the anomaly detection results.

[0204] During the traversal process, nodes and edge types undergo state transitions. In each transition step, the transition probability is calculated based on the connection strength between nodes, semantic relevance, and historical traversal statistics. The restart mechanism ensures that the traversal process can return to the starting node with a preset probability, avoiding excessive deviation from the target search path.

[0205] Path evaluation and instantiation assess the confidence of all paths discovered during the traversal. The confidence calculation comprehensively considers the traversal probability, semantic consistency, and business rationality of the path. Paths with confidence exceeding a preset threshold are instantiated as candidate abnormal chains. Each candidate abnormal chain contains a complete node sequence, edge relationships, and corresponding confidence score.

[0206] Through this template-driven path search mechanism, the system can automatically discover business-significant anomaly propagation and evolution patterns from complex heterogeneous graph structures.

[0207] Extract the original time-series power consumption data corresponding to adjacent node pairs in each candidate anomaly chain;

[0208] The time-series electricity consumption data is input into the causal relationship verification model. After excluding the influence of other variables, statistical hypothesis testing is used to determine whether each time series has predictive power for another time series.

[0209] Calculate the causal strength score for each candidate anomaly chain, which is determined by the causal relationships between all adjacent node pairs in the anomaly chain.

[0210] Specifically, for each candidate anomaly chain generated by path search, the corresponding original time-series electricity consumption data needs to be extracted for causal relationship verification.

[0211] A preferred example involves identifying all adjacent node pairs in a candidate anomaly chain based on the node sequence recorded in the chain. For each node pair, complete time-series observation data for the corresponding time period is extracted from its corresponding original electricity consumption dataset. The time frame for data extraction should cover a sufficient window before and after the anomaly to ensure that complete causal interaction patterns can be captured.

[0212] like Figure 4 As shown, the extracted time-series data needs to undergo unified preprocessing, including data alignment, missing value handling, and standardization.

[0213] Data alignment ensures that timestamps from different nodes correspond perfectly; missing values ​​are filled using interpolation methods based on time series features; standardization eliminates the influence of different units on causal relationship judgments, making the data meet the input requirements of the validation model.

[0214] Statistical validation of causal relationships involves inputting preprocessed time-series data into a validation model based on conditional Granger causality to perform rigorous statistical hypothesis testing.

[0215] One preferred example of a verification model for causality is conditional Granger causality;

[0216] Specifically, the conditional Granger causality test is used to determine whether one time series has predictive power for another time series, while controlling for the influence of other relevant variables. The test process involves building a vector autoregressive model of all relevant variables and then comparing the difference in predictive power for the outcome variable with and without the suspected causal variable through hypothesis testing.

[0217] The causality strength score is calculated by summing the causality strength scores for each candidate abnormal chain:

[0218] The score calculation comprehensively considers the causal relationship evidence between all adjacent node pairs in the chain. The individual causal strength of each node pair is determined by the significance level p of the Granger causality test and the effect size. The weighted geometric mean is used to synthesize these two indicators into the causal strength score of the node pair.

[0219] Furthermore, the vector autoregression model can be constructed into a multivariate time series analysis model, which can take into account the mutual influence relationships between multiple variables.

[0220] A preferred construction process is as follows: determine the lag order of the model, i.e., how many past time points the influence should be considered; establish an equation system containing all relevant variables, where each equation describes how a variable is affected by its own and other variables' historical values; and finally estimate the parameters of the vector autoregressive model using optimization algorithms such as least squares to obtain the complete vector autoregressive model.

[0221] like Figure 4 As shown, further, Granger causality tests are performed using the established vector autoregression model:

[0222] A preferred example of Granger causal inertial frame verification is as follows: the null hypothesis for the test is set as variable X is not a Granger cause of variable Y.

[0223] To verify this hypothesis, it is necessary to compare the predictive performance of two vector autoregressive models. The vector autoregressive models include the historical values ​​of variables X and Y as predictors, respectively; while the constrained model excludes the historical values ​​of variable X and only includes the historical values ​​of variable Y itself and other control variables.

[0224] The F-test is used to assess the predictive difference between the two models, calculating the F-statistic and its corresponding p-value. The F-statistic measures the significance of the improvement in predictive ability after adding variable X. When the calculated p-value is lower than the pre-set significance level, the null hypothesis is rejected, and variable X is considered a Granger cause of variable Y.

[0225] After confirming the existence of a significant Granger causal relationship, it is necessary to further quantify the strength of the causal effect. The magnitude of the causal effect is calculated by comparing the degree of improvement in the prediction of the outcome variable with and without the causal variable. The cumulative effect of the causal variable on the outcome variable is calculated by analyzing the coefficient matrix in the vector autoregressive model.

[0226] The magnitude of the cumulative effect reflects the extent to which a unit change in the causal variable causes a change in the outcome variable.

[0227] The calculation of effect size takes into account both direct and indirect effects, and captures the dynamic interactions between variables through impulse response analysis or variance decomposition.

[0228] It should be noted that those skilled in the art can combine impulse response analysis or variance decomposition methods in the field with the technical means disclosed in this application to learn how to capture the dynamic interaction between variables based on impulse response analysis or variance decomposition methods.

[0229] The final causal strength score of the entire candidate anomaly chain is calculated by multiplying the causal strength scores of all adjacent node pairs in the chain. This product calculation method ensures that the entire anomaly chain can obtain a high causal strength score only when each link in the chain has a strong causal relationship. The final causal strength score is a normalized value between 0 and 1. The higher the score, the more significant and reliable the causal relationship of the anomaly chain.

[0230] This application effectively distinguishes between genuine causal anomaly chains and accidental temporal associations through statistical causality verification, significantly improving the accuracy and reliability of anomaly chain detection. The conditional Granger causality verification method can eliminate the influence of confounding variables, ensuring that the discovered anomaly chains have genuine causal significance.

[0231] Set a causal strength threshold, and filter out candidate abnormal chains whose causal strength scores exceed the threshold as high-confidence power consumption abnormal chains;

[0232] The power consumption anomaly chain is output in a directed graph structure, where nodes represent the user, anomaly type, and time of the anomaly, and edges represent verified causal relationships. The directed graph represents the entire chain of information on the evolution of the anomaly event from its origin to its propagation path.

[0233] Specifically, a causal strength threshold is set to filter out anomalous chains with high confidence:

[0234] Furthermore, the causal strength threshold is set using the quantile method of historical validation data, placing the causal strength threshold at a position that ensures a low false alarm rate while maintaining high detection efficiency.

[0235] An example of a preferred causal strength threshold: By analyzing the score distribution of verified causal chains in historical anomalies, an appropriate quantile can be selected as the benchmark for the causal strength threshold. The causal strength threshold can be dynamically adjusted according to the fault tolerance requirements of the actual application scenario; the threshold can be appropriately increased in scenarios with high accuracy requirements, and appropriately decreased in scenarios requiring comprehensive monitoring.

[0236] The screening process compares the causal strength score of each candidate anomalous chain with a set threshold, retaining only anomalous chains whose scores exceed the threshold. The screening process also considers the integrity and continuity of the anomalous chains to ensure that the final output anomalous chains contain a complete path from origin to evolution.

[0237] The directed graph structure output and visualization outputs and displays the selected high-confidence power consumption anomaly chains in a standardized directed graph structure:

[0238] The node representation employs a multi-attribute node design, with each node containing three core attributes: user identifier, exception type, and timestamp. The node visual encoding uses different shapes, colors, and sizes to distinguish the importance of exception types and the time of their occurrence.

[0239] The edge relationship is represented by directed edges with arrows to indicate verified causal relationships. The direction of the edge indicates the direction of anomaly propagation, and the thickness of the edge intuitively reflects the strength of the causal relationship. Each edge is marked with a corresponding causal strength score, providing users with a quantitative confidence reference.

[0240] The integration of information across the entire chain fully presents the three key dimensions of abnormal events through the topological structure of a directed graph: the origin node identifies the initial point of occurrence of the abnormality, the propagation path shows the spread trajectory of the abnormality among users, and the evolution process reflects the changing pattern of the abnormality type over time.

[0241] The exception chain provides a business-level semantic interpretation of the output exception chain, transforming the technical graph structure into a business logic that operations and maintenance personnel can understand:

[0242] Origin analysis clearly identifies the starting node of the anomaly chain, analyzes the power consumption characteristics and anomaly type of that node, and provides key clues for tracing the root cause of the anomaly.

[0243] The propagation path analysis provides a detailed description of the sequence and scope of anomaly propagation among users, identifying key nodes and vulnerable points in the propagation process.

[0244] The evolution process tracking clearly shows the trajectory of anomaly types changing over time, including the escalation or de-escalation of anomaly severity and the transformation of anomaly nature.

[0245] This application uses scientifically set thresholds to screen high-confidence anomaly chains and combines directed graph visualization technology to achieve interpretable and operable output of complex anomaly propagation patterns. This not only improves the credibility of anomaly detection results but also provides power grid operation and maintenance personnel with an intuitive and comprehensive perspective on anomaly analysis, supporting rapid and accurate decision-making and response actions.

[0246] It is important to note that the constructions and arrangements of this application shown in several different exemplary embodiments are merely illustrative. Although only two embodiments are described in detail in this disclosure, those who consult this disclosure will readily understand that many modifications are possible without substantially departing from the novel teachings and advantages of the subject matter described in the application. For example, variations in the size, dimensions, structure, shape, and proportions of various elements, as well as parameter values ​​(e.g., temperature, pressure, etc.), mounting arrangements, use of materials, color, orientation, etc. For instance, an element shown as integrally formed may be composed of multiple parts or elements, the position of elements may be inverted or otherwise altered, and the nature or number or position of discrete elements may be changed or altered. Therefore, all such modifications are intended to be included within the scope of the invention. The order or sequence of any process or method steps may be changed or rearranged according to alternative embodiments. Any "device plus function" clause is intended to cover the structure performing the function described herein, and not only structurally equivalent but also equivalent in structure. Other substitutions, modifications, alterations, and omissions may be made in the design, operation, and arrangement of the exemplary embodiments without departing from the scope of the invention. Therefore, the present invention is not limited to the specific embodiments, but extends to various modifications that still fall within the scope of the appended claims.

[0247] Furthermore, in order to provide a concise description of exemplary embodiments, not all features of actual embodiments (i.e., those features that are not relevant to the best mode of carrying out the invention as currently considered, or those features that are not relevant to implementing the invention) may be omitted.

[0248] It should be understood that numerous specific implementation decisions can be made during the development of any actual implementation method, and in any engineering or design project. Such development efforts may be complex and time-consuming, but for those of ordinary skill in the art who benefit from this disclosure, the development effort will be a routine task in design, manufacturing, and production without requiring extensive experimentation.

[0249] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for constructing abnormal power consumption chains for dedicated transformer users by integrating deep learning, characterized in that, include: S1. Collect time-series electricity consumption data and power grid topology data of dedicated transformer users, and construct a graph structure containing physical connection edges and behavioral association edges, with each dedicated transformer user as a node; S2. Input the constructed graph structure into the spatiotemporal graph neural network model, extract spatiotemporal features, introduce power grid physical constraints into the optimization objective, embed the power grid operation law as a constraint into the model, and output multi-level anomaly detection results at the node level, edge level and subgraph level. S3. Construct a heterogeneous graph containing user nodes, anomaly type nodes, and time slice nodes based on the multi-level anomaly detection results. Perform path search in the heterogeneous graph using a predefined association pattern template to generate candidate anomaly chains. Use a time-series causal relationship verification model to verify the causal strength of the candidate anomaly chains and output a high-confidence power consumption anomaly chain. The power consumption anomaly chain is used to characterize the origin, propagation path, and evolution process of the abnormal event.

2. The method for constructing anomaly chains for dedicated transformer users by incorporating deep learning as described in claim 1, characterized in that: The physical connection edges are determined by the power grid topology; The behavioral association edges are dynamically generated by analyzing the morphological similarity between user electricity consumption data curves.

3. The method for constructing anomaly chains for dedicated transformer users by incorporating deep learning as described in claim 2, characterized in that: The method for constructing a graph structure containing physical connection edges and behavioral association edges includes: S101. Collect the electrical connection relationships between dedicated transformer users recorded in the power grid geographic information system, and generate the physical connection edges through the electrical connection relationships to represent the inherent physical power grid links between users; S102. Synchronously collect the time-series electricity consumption data of each special transformer user, and calculate the similarity measure of the electricity consumption data curve shape between any two users within a set time window. S103. Set a similarity threshold. If the similarity metric exceeds the threshold, create a behavior association edge between the two user nodes to construct a dynamic association network that reflects the similarity of user electricity consumption behavior. The physical connection edges and behavioral association edges constitute a graph structure that shows the relationship between the special transformer user group in both physical and behavioral dimensions.

4. The method for constructing anomaly chains for dedicated transformer users by incorporating deep learning as described in claim 1, characterized in that: The spatiotemporal graph neural network model is composed of multiple spatiotemporal blocks connected in series. The graph structure is a multimodal graph structure, including a node feature matrix and an adjacency matrix. The node feature matrix is ​​composed of the time-series electricity consumption data of the dedicated transformer user collected. Each of the spatiotemporal blocks contains a graph convolutional layer and a temporal convolutional layer; The node feature matrix and the adjacency matrix defined by physical connection edges and behavioral association edges in the multimodal graph structure are used as inputs to the spatiotemporal graph neural network model.

5. The method for constructing anomaly chains for dedicated transformer users by incorporating deep learning as described in claim 4, characterized in that: In the spatiotemporal block, spatial information is aggregated along the connection relationship defined by the adjacency matrix through the graph convolutional layer to capture the local spatial neighborhood features of each node in the graph; The aggregated local spatial neighborhood features are input into the temporal convolutional layer, which captures the dynamic evolution of each node in the time dimension by performing a one-dimensional convolution operation in the time dimension. The node embedding representation obtained after processing through multiple spatiotemporal blocks is used as the final extracted spatiotemporal feature that integrates spatial dependence and temporal evolution.

6. The method for constructing anomaly chains for dedicated transformer users by incorporating deep learning as described in claim 1, characterized in that: The optimization objective is composed of both task loss and physical constraint loss; The physical constraint loss is designed based on Kirchhoff's current law and is constructed by calculating the difference between the sum of the power data of the parent node and the child node in the time-series power consumption data in the graph structure. The spatiotemporal features are input into three parallel fully connected layers and activation functions, respectively, to generate anomaly detection results at three levels.

7. The method for constructing anomaly chains for dedicated transformer users by incorporating deep learning as described in claim 1, characterized in that: Based on the user nodes in the multi-level anomaly detection results, create anomaly type nodes and time slice nodes: The abnormal type node is defined by the abnormal category in the node-level, edge-level, and subgraph-level anomaly detection results; Time slice nodes are defined by discretizing the time interval after the timestamp of the anomaly occurs; The relationships recorded in the anomaly detection results are used to establish connection edges between user nodes, anomaly type nodes, and time slice nodes, constructing a heterogeneous graph containing multiple node types and relationship types.

8. The method for constructing anomaly chains for dedicated transformer users by incorporating deep learning as described in claim 1, characterized in that: Two association pattern templates are predefined, which specify the sequence of node and edge types that are allowed to roam in a heterogeneous graph, including a propagation template and an evolution template; The propagation template is defined as a sequence of user nodes, exception type nodes, and user nodes, used to search for the propagation path of exceptions among users; An evolution template is defined as a sequence of user nodes, exception type nodes, time slice nodes, exception type nodes, and user nodes, used to search for the evolution path of the same user exception over time. By restarting the random walk to search for paths in the heterogeneous graph, paths with a walk probability exceeding a preset threshold are instantiated as candidate abnormal chains.

9. The method for constructing anomaly chains for dedicated transformer users by incorporating deep learning as described in claim 8, characterized in that: Extract the original time-series power consumption data corresponding to adjacent node pairs in each candidate anomaly chain; The time-series electricity consumption data is input into the causal relationship verification model. After excluding the influence of other variables, statistical hypothesis testing is used to determine whether each time series has predictive power for another time series. Calculate the causal strength score for each candidate anomaly chain, which is determined by a causal relationship between all adjacent node pairs in the anomaly chain.

10. The method for constructing anomaly chains for dedicated transformer users by incorporating deep learning as described in claim 9, characterized in that: Set a causal strength threshold, and filter out candidate abnormal chains whose causal strength scores exceed the threshold as high-confidence power consumption abnormal chains; The power consumption anomaly chain is output in a directed graph structure, where nodes represent the user, anomaly type, and time of the anomaly, and edges represent verified causal relationships. The directed graph represents the entire chain of information on the evolution of the anomaly event from its origin to its propagation path.

Images