Linkage anomaly analysis method and system for abnormal triggering of medium and low voltage power grid

Abstract

According to the linkage anomaly analysis method and system for abnormal triggering of the medium and low voltage power grid, more data points in different types are obtained by performing storage and feature extraction on the data stream, meanwhile, the association relationship between different devices and different types of data is constructed, and the linkage anomaly triggering accuracy of the medium and low voltage power grid is improved through establishment of the feature vector association relationship. Different anomaly standards under each type item are quantified, and corresponding suspected anomaly points are evaluated according to the incidence relation to serve as secondary training samples, so that an anomaly propagation model is constructed, and interference of useless data on construction of the anomaly propagation model is avoided. And meanwhile, the anomaly propagation model generated by the suspected anomaly points through constructing the association relationship can be adjusted and optimized according to the change of the scene and the use condition, so that the reliability of the system and the timeliness and the accuracy of anomaly discovery are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, in particular to a method and system for analyzing abnormal linkage triggered by abnormality of a medium or low voltage power grid. BACKGROUND

[0002] Problem background:

[0003] In the analysis of abnormal events of a power grid, a key technical problem is how to accurately and comprehensively identify and locate abnormalities from massive monitoring data. The power grid covers a wide area and involves many aspects such as power generation, power transmission, power transformation, power distribution, and power consumption. A large number of monitoring devices are deployed in each aspect, generating massive and various real-time monitoring data. Abnormality judgment needs to consider the changes of multiple electrical parameters such as voltage, current, power, and frequency, as well as the influence of external factors such as weather and load. It is difficult to evaluate the severity and influence range of an event only by using a single indicator or data from a few key measuring points.

[0004] In addition, the topology of the power grid is complex and there are multiple coupling relationships between different regions and different devices. Local abnormalities can spread rapidly, triggering a chain reaction and causing large-scale power outages or equipment damage. The signs of global abnormalities may be hidden in multiple scattered local abnormal signals, and subtle abnormalities accumulate to a certain extent before triggering an accident. Real-time processing and correlation analysis of massive heterogeneous data also puts high requirements on the generalization ability and adaptability of the abnormality identification model.

[0005] Accurate determination of the time, location, and severity of abnormality, comprehensive assessment of the impact and development trend of the accident, and mining of the correlation and propagation rules between abnormalities are difficult problems to be solved in intelligent analysis technology of power grid abnormalities. This requires deep integration of power physical models, big data analysis, artificial intelligence, and other multidisciplinary knowledge, balancing the complexity and real-time performance of the model, ensuring the accuracy and comprehensiveness of the analysis while minimizing the computational cost, and providing reliable support for business applications such as monitoring and dispatching, emergency disposal, etc. SUMMARY

[0006] The purpose of the present application is to provide an automatic abnormality identification method and system based on data analysis and training of the propagation rules of power grid abnormalities, which can correlate and comprehensively analyze multiple abnormal details.

[0007] The present application provides a method for analyzing abnormal linkage triggered by abnormality of a medium or low voltage power grid,

[0008] Step S1, obtaining monitoring information of a monitoring device, and processing the monitoring information according to a preset format coordination strategy to generate a standardized power grid data set;

[0009] Step S2, extracting feature vectors in the standardized power grid data set by a preset multi-dimensional vector feature extraction strategy to generate a feature vector subset corresponding to each monitoring device;

[0010] Step S3, taking the feature vector subset as a sample, training a feature anomaly recognition model by an unsupervised learning algorithm, identifying the corresponding abnormal data points in the monitoring device through the feature anomaly recognition model, and calculating the anomaly scores of the abnormal data points through a preset isolation forest algorithm, and marking the data points with anomaly scores higher than a preset anomaly score threshold as suspected abnormal points;

[0011] Step S4, constructing an anomaly propagation model by bringing the suspected abnormal points into a graph neural network;

[0012] Step S5, supervising the corresponding monitoring device of the power grid through the anomaly propagation model.

[0013] Further, the step S1 further includes a preprocessing sub-strategy, and the preprocessing sub-strategy includes

[0014] Step S11, acquiring a multi-source heterogeneous real-time data stream, determining the format and type of the original data stream by analyzing the protocols and data structures of different data sources;

[0015] Step S12, time aligning the real-time data streams from different sources according to a predefined same time standard, and if the original data stream timestamp is abnormal, acquiring predicted data at the corresponding time through a preset data completion sub-strategy;

[0016] Step S13, processing the data stream through a preset standard format to obtain a standard format data stream;

[0017] Step S14, uniformly normalizing the corresponding standard format data stream through a preset normalization standard;

[0018] Step S15, performing Z-score standardization processing on the normalized data to obtain a standard score with a mean of 0 and a standard deviation of 1, and screening standard score data conforming to the normal distribution;

[0019] Step S16, constructing a corresponding power grid operation data set according to the standard score data.

[0020] Further, the data completion sub-strategy includes:

[0021] Step S121, acquiring data streams uploaded by each monitoring device of the power grid, including real-time voltage, real-time current, real-time power and real-time frequency;

[0022] Step S122, acquire the environmental temperature and humidity data reported by the environmental monitoring device, associate the data source with the power grid node attribute, determine the environmental data set of each node of the power grid, fuse the power grid operation data set, and obtain the power grid state holographic data set containing environmental factors;

[0023] Step S123, classify the power grid state holographic data set according to the load level, establish a data set under different load levels, and determine the normal fluctuation range of voltage, current, power and frequency under different load levels;

[0024] Step S124, construct an event dynamic case model from historical power grid operation data, and the event dynamic case model reflects the change constraint of each data under the corresponding event scenario;

[0025] Step S125, acquire the event scenario corresponding to the target time period of missing data, and according to the event scenario, retrieve the corresponding change constraint from the event dynamic case model, and calculate the corresponding missing data through the change constraint and the known data.

[0026] Further, the multi-dimensional vector feature extraction strategy includes

[0027] Step S21, acquire the reference data type of the corresponding data, and according to the reference data type, retrieve the vector construction group from the pre-constructed vector type table, each vector construction group including several different vector feature items;

[0028] Step S22, calculate the feature vector of the corresponding data under different vector feature items;

[0029] Step S23, integrate the feature vectors to generate a comprehensive feature vector through the integration correction sub-strategy;

[0030] Step S24, respectively cluster analyze each period of comprehensive feature vectors to obtain corresponding cluster clusters, and mark the corresponding comprehensive feature vectors according to the cluster type to generate the feature vector subset.

[0031] Further, the vector feature item includes a statistical feature item, a time series feature item and a frequency domain feature item, the statistical feature item includes mean, maximum, minimum and variance, and the time series feature item includes change rate and trend measure.

[0032] Further, the feature anomaly identification model comprises corresponding verification layers with different verification conditions, each verification condition corresponding to different data verification accuracy and data acquisition frequency, the feature anomaly identification model captures verification type features in the corresponding monitoring historical data set, matches the corresponding verification layer according to the verification type features, calls the corresponding to-be-verified data according to the verification layer, obtains the original data class of the to-be-verified data to calculate the abnormal sub-features in the to-be-verified data according to the original data class, and marks the abnormal position corresponding to the to-be-verified data with an abnormal sub-value greater than a preset value as an abnormal data point.

[0033] Further, the spatial correlation and the electrical correlation of the abnormal data point are calculated by the isolation forest algorithm, and the spatial correlation and the electrical correlation are brought into a pre-constructed abnormal correlation graph to generate an abnormal correlation strength, the abnormal sub-score is calculated according to the abnormal correlation strength, and the abnormal score of the position is calculated by a corresponding abnormal correlation weighting formula.

[0034] Further, the graph neural network comprises a plurality of abnormal points, each abnormal point is provided with a plurality of abnormal point items, each abnormal point corresponds to a corresponding monitoring device, the abnormal point item corresponds to an abnormal type, and the abnormal point items are connected through a graph network line, when any two abnormal point items have the same event trigger feature, the corresponding graph network line is corrected according to the event trigger feature to construct the graph neural network, when any continuous network path in the graph neural network meets a preset trigger constraint condition, the corresponding network path is taken as an abnormal event propagation path to construct the abnormal propagation model, and the abnormal propagation model comprises a plurality of abnormal event propagation paths, each abnormal event propagation path comprises a plurality of abnormal point items and a point item association line in a trigger state.

[0035] Further, the abnormal propagation model further comprises a propagation law mirroring strategy, the propagation law mirroring strategy calculates the similarity of the abnormal event transmission path, when the similarity of any abnormal event transmission path is greater than a preset convergence condition, a propagation law is generated according to the abnormal event transmission path, and an added trigger value is generated according to the propagation law, when the features of the graph neural network meet the propagation law, the corresponding network path is given the added trigger value to meet the corresponding trigger constraint condition.

[0036] The application also provides a linkage abnormality analysis system for abnormal triggering of a medium-low voltage power grid, which is configured with any one of the linkage abnormality analysis methods for abnormal triggering of a medium-low voltage power grid, and characterized in that the linkage abnormality analysis system comprises a data acquisition module, a data standardization module, a feature extraction module, an anomaly identification module, an abnormal propagation modeling module and an abnormal triggering and comprehensive module.

[0037] The data acquisition module is used for acquiring real-time data streams of different monitoring devices.

[0038] The data standardization module is used for processing real-time data streams;

[0039] The feature extraction module is used for extracting feature vectors corresponding to data streams in the corresponding historical data set;

[0040] The anomaly identification module is used for identifying suspected abnormal points in the corresponding historical data set;

[0041] The anomaly propagation modeling module is used for constructing an anomaly propagation model according to the suspected abnormal points;

[0042] The anomaly triggering and comprehensive module is used for supervising the obtained real-time data streams by the anomaly identification model to generate an anomaly result.

[0043] The technical scheme of the present application can include the following beneficial effects: by storing data streams and extracting features to obtain more data points under different types, the correlation between different devices and different types of data is constructed, the different anomaly standards under each type are quantified through the establishment of the feature vector correlation, and the corresponding suspected abnormal points are evaluated as secondary training samples to construct an anomaly propagation model, thereby avoiding the interference of useless data on the construction of the anomaly propagation model, and the suspected abnormal points generated by the anomaly propagation model constructed through the correlation are adjusted and optimized according to the changes in the scene and use, thereby improving the system reliability and the timeliness and accuracy of abnormal discovery. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 The flowchart of the abnormal triggering linkage abnormal analysis method of the medium and low voltage power grid of the present application.

[0045] Figure 2 The schematic diagram of the abnormal triggering linkage abnormal analysis method and system of the medium and low voltage power grid of the present application.

[0046] Figure 3 The schematic diagram of the abnormal triggering linkage abnormal analysis method and system of the medium and low voltage power grid of the present application.

[0047] Figure 4 The structural schematic diagram of the abnormal triggering linkage abnormal analysis method and system of the medium and low voltage power grid of the present application DETAILED DESCRIPTION

[0048] The technical scheme of the present application will be described clearly and completely below in conjunction with embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0049] A method for analyzing abnormal linkage triggered by abnormality of a medium-low voltage power grid,

[0050] In step S1, monitoring information of a monitoring device is acquired, and the monitoring information is processed according to a preset format coordination strategy to generate a standardized power grid data set.

[0051] The step S1 further includes a preprocessing sub-strategy, and the preprocessing sub-strategy includes the following step S11: acquiring a multi-source heterogeneous real-time data stream, determining the format and type of the original data stream by analyzing the protocols and data structures of different data sources.

[0052] Specifically, the monitoring devices of each link of the power grid, such as smart meters, phasor measurement units, and sensors, upload the generated real-time data stream to the data center through 4G / 5G, optical fiber, and other communication methods. For example, a smart meter on a certain 10kV distribution line uploads data every 15 seconds, and the data packet contains three-phase voltage, three-phase current, active power, reactive power, and frequency data at that moment. At the same time, the sensors deployed by the weather station also upload environmental data every 5 minutes through a wireless network, including temperature, humidity, wind speed, etc. The load data is collected through the monitoring and data acquisition system, for example, the total load on the 10kV side of a certain substation is 1000kW, which is obtained through a data interface every minute. After these data streams of different sources and different frequencies are merged into the data center, data cleaning and preprocessing are first performed, including handling missing values and removing outliers. Then, a streaming computing framework is used for real-time processing of the data. For example, the voltage unbalance degree is calculated, and the specific algorithm is as follows: the average value of the three-phase voltage effective values is calculated, and then the deviation percentage of each phase voltage from the average value is calculated: the maximum absolute value of the deviation is taken as the voltage unbalance degree. At the same time, correlation analysis can be performed using load data and environmental data, for example, the Pearson correlation coefficient is used to calculate the correlation between temperature and load, and it is assumed that the Pearson correlation coefficient obtained through calculation is 85, indicating that there is a strong positive correlation between temperature and load. These processed and analyzed data can be used for real-time monitoring, fault diagnosis, load forecasting, and other applications of the power grid.

[0053] In step S12, the real-time data streams of different sources are time-aligned according to a predefined same time standard, and if the time stamp of the original data stream is abnormal, the predicted data at the corresponding time is obtained through a preset data completion sub-strategy; the data completion sub-strategy includes the following steps:

[0054] In step S121, data streams containing real-time voltage, real-time current, real-time power, and real-time frequency uploaded by each monitoring device of the power grid are acquired.

[0055] Step S122, the environment temperature and humidity data reported by the environment monitoring device are acquired, the environment data set of each node of the power grid is determined through the association of data sources and power grid node attributes, the power grid state holographic data set containing environmental factors is obtained by fusing the power grid operation data set;

[0056] Step S123, the power grid state holographic data set is classified according to the load level, the data set under different load levels is established, and the normal fluctuation range of voltage, current, power and frequency under different load levels is determined; specifically, the data stream containing real-time voltage, real-time current, real-time power and real-time frequency uploaded by each monitoring device of the power grid is acquired, data alignment is performed through data time mark, and the power grid operation data set under a unified time reference is obtained;

[0057] The environment temperature and humidity data reported by the environment monitoring device are acquired, the environment data set of each node of the power grid is determined through the association of data sources and power grid node attributes, the power grid state holographic data set containing environmental factors is obtained by fusing the power grid operation data set;

[0058] The power grid state holographic data set is classified according to the load level, the data set under different load levels is established, and the normal fluctuation range of voltage, current, power and frequency under different load levels is determined by using a statistical analysis method;

[0059] On the other hand, if the real-time voltage, real-time current and real-time power or real-time frequency exceed the normal fluctuation range, an abnormal alarm is triggered, and the specific location where the abnormality occurs is located through the power grid node attribute;

[0060] According to the abnormal alarm information, data within a period of time before and after the occurrence of the abnormality is extracted from the power grid state holographic data set, time series data is constructed, and input into a pre-established abnormal diagnosis model based on a long short-term memory network;

[0061] The change trend of the time series data is analyzed through the LSTM model to obtain an abnormal type judgment result;

[0062] If the judgment result is that the power grid is overloaded, a load transfer operation is performed;

[0063] According to the power grid state holographic data set after the load transfer operation, a prediction model is constructed by using a random forest algorithm or a gradient boosting tree algorithm to obtain a prediction result of the power grid state at the next moment after the operation.

[0064] Step S124, a historical power grid operation data event dynamic case model is constructed, and the event dynamic case model reflects the change constraint of each data under a corresponding event scenario;

[0065] Step S125, an event scene corresponding to the target time period of missing data is acquired, and a corresponding change constraint is retrieved from an event dynamic case model according to the event scene, and the corresponding missing data is calculated through the change constraint and the known data.

[0066] Step S13, processing the data stream through a preset standard format to obtain a standard format data stream;

[0067] Step S14, normalizing data corresponding to the standard format data stream through a preset normalization standard;

[0068] Step S15, the normalized data is subjected to Z-score standardization to obtain standard scores with a mean of 0 and a standard deviation of 1, and standard score data conforming to normal distribution is screened; multi-source heterogeneous real-time data streams are obtained, the formats and types of the original data streams are determined by analyzing the protocols and data structures of different data sources. According to a predefined uniform time granularity, the real-time data streams from different sources are subjected to time alignment processing, and if the original data stream timestamps do not meet the requirements, the data under the uniform time granularity is obtained through interpolation or resampling methods. For the data with aligned time, a unified data format is adopted for conversion, different formats of data are converted into a preset unified format, and data streams with consistent formats are obtained. Through the set normalization parameters, the minimum-maximum normalization method is selected to scale the data streams with converted formats, and normalized data with a numerical range in a preset interval is obtained. According to the normalized data, the mean and standard deviation of each data dimension in a period of time are calculated to obtain the statistical quantities required for Z-score standardization. The statistical quantities obtained are used to perform Z-score standardization on the normalized data to obtain standard scores with a mean of 0 and a standard deviation of 1, and it is determined that the data conforms to normal distribution. The standard scores processed through the above steps form a standardized power grid operation data set, and it is determined that the data set can be used for subsequent power grid state analysis and prediction model training and application. Specifically, assuming that the power grid real-time data streams come from three different data sources: a monitoring and data acquisition system, a phasor measurement unit and a meteorological data system. First, the time granularity and data format are unified, and all data are converted into a time granularity of seconds and a CSV format. For example, the monitoring and data acquisition system data does not need to be converted, the phasor measurement data is averaged every 1000 data points to be combined into second-level data, and the meteorological data is obtained and expanded to fill in every second to form second-level data. Assuming that the original value of the monitoring and data acquisition system voltage data is 225kV, 228kV and 219kV, the original value of the PMU current data is 1001A, and the original value of the meteorological data temperature is 21℃, after filling from minutes to seconds, the temperature is 21℃ for 60 consecutive seconds. Then, the normalization processing is performed, and assuming that the preset interval is [0, 1]. For voltage data, find the maximum value 225kV and the minimum value 219kV, use the formula: (original value-minimum value) / (maximum value-minimum value), normalize 225kV to (225-219) / (225-219)=1, normalize 228kV to (228-219) / (225-219)=5625, and normalize 219kV to 0. For current data, assuming that the historical maximum value is 1200A and the minimum value is 800A, 1001A is normalized to (1001-800) / (1200-800)=5025.For temperature data, assuming the historical maximum temperature is 40℃ and the minimum temperature is -10℃, then 21℃ is normalized as (21-(-10)) / (40-(-10)) = 702. Finally, the mean and standard deviation of all normalized data are calculated by Z-score standardization method. Assuming that the mean of the normalized voltage data is 6 and the standard deviation is 2; the mean of the normalized current data is 5 and the standard deviation is 15; the mean of the normalized temperature data is 7 and the standard deviation is 1. Using the formula: (normalized value-mean) / standard deviation. The normalized voltage value 5625 is standardized as (5625-6) / 2 = -1875. The current value 5025 is standardized as (5025-5) / 15 = 0167. The temperature value 702 is standardized as (702-7) / 1 = 02. After these processes, all data of different sources and different formats are converted into a distribution with a mean of 0 and a standard deviation of 1, forming a standardized power grid operation data set, which can be used for the next step of analysis. These standardized data can be used as input for machine learning models to assess the state of the power grid, predict faults, etc.

[0069] Step S16, constructing a corresponding power grid operation data set according to the standard score data.

[0070] Specifically, the real-time data stream of different sources and different formats is standardized, the time granularity and data format are unified, the real-time data stream is scaled to a preset interval by normalization method, and the real-time data stream is converted into a distribution with a mean of 0 and a standard deviation of 1 by Z-score standardization method, forming a standardized power grid operation data set, including:

[0071] Obtain multi-source heterogeneous real-time data stream, determine the format and type of the original data stream by analyzing the protocol and data structure of different data sources;

[0072] According to the pre-defined unified time granularity, the real-time data stream of different sources is time-aligned, if the original data stream timestamp does not meet the requirements, then the data under the unified time granularity is obtained by interpolation or resampling method;

[0073] For the time-aligned data, a unified data format is used for conversion, different formats of data are converted into a preset unified format, and data streams with consistent formats are obtained;

[0074] By setting the normalization parameters, the minimum-maximum normalization method is selected to scale the data stream with converted format, and the normalized data with a numerical range in the preset interval is obtained;

[0075] According to the normalized data, the mean and standard deviation of each data dimension in a period of time are calculated, and the statistical quantities required for Z-score standardization are obtained;

[0076] The calculated statistics are used to perform Z-score standardization on the normalized data to obtain standard scores with a mean of 0 and a standard deviation of 1, and to determine that the data conforms to a normal distribution;

[0077] The standard scores processed by the above steps form a standardized power grid operation data set, and it is determined that the data set can be used for subsequent power grid state analysis and prediction model training and application.

[0078] Step S2, extracting feature vectors in the standardized power grid data set by a preset multi-dimensional vector feature extraction strategy to generate a feature vector subset corresponding to each monitoring device;

[0079] The multi-dimensional vector feature extraction strategy includes

[0080] Step S21, obtaining a reference data type corresponding to the data, and calling a vector construction group from a pre-constructed vector type table according to the reference data type, each vector construction group including several different vector feature items;

[0081] Step S22, calculating the feature vectors of the corresponding data under different vector feature items;

[0082] Step S23, integrating the feature vectors by an integration correction sub-strategy to generate a comprehensive feature vector;

[0083] Step S24, respectively clustering the comprehensive feature vectors of each time period to obtain corresponding cluster clusters, and marking the corresponding comprehensive feature vectors according to the cluster type of the cluster cluster to generate the feature vector subset.

[0084] Specifically, the standardized power grid operation data set is extracted to reflect the power grid operation state, and the multiple feature vectors include statistical feature vectors, time series feature vectors and frequency domain feature vectors, the statistical feature vectors include mean, variance, maximum value and minimum value, the time series feature vectors include change rate and trend measure, and the frequency domain feature vectors include main frequency, frequency spectrum centroid and frequency spectrum bandwidth, including:

[0085] The standardized power grid operation data set is obtained, the data of each measurement point in the data set is preprocessed to eliminate abnormal values and noise, and a preprocessed data set is obtained;

[0086]

[0087] min i min represents the minimum value of the i-th measurement point, N represents the sample number, and x i j represents the j-th sample value of the i-th measurement point;

[0088]

[0089] F i statistical feature vector of the i-th measurement point, containing mean μ i , variance maximum max i and minimum min i ;

[0090] Calculate the statistical features of each measurement point data in the preprocessed data set, including mean, variance, maximum and minimum, to obtain the statistical feature vector;

[0091] According to the preprocessed data set, calculate the change rate of each measurement point data, and obtain the time series feature vector by dividing the difference between the data of the two time points by the time interval and analyzing the trend of the change rate data over time.

[0092] Perform fast Fourier transform on the preprocessed data set to convert the time domain signal to the frequency domain signal and obtain the frequency spectrum data;

[0093] Analyze the frequency spectrum data to find the frequency corresponding to the peak value in the frequency spectrum, determine the main frequency, calculate the weighted average frequency of the frequency spectrum to obtain the frequency spectrum centroid, calculate the width of the frequency spectrum energy concentration region to obtain the frequency spectrum bandwidth, and obtain the frequency domain feature vector.

[0094]

[0095] variance of the i-th measurement point, N represents the number of samples, x i j represents the j-th sample value of the i-th measurement point, μ i represents the mean of the i-th measurement point;

[0096]

[0097] max i represents the maximum value of the i-th measurement point, N represents the number of samples, x i j represents the j-th sample value of the i-th measurement point;

[0098] weighted average frequency of the frequency spectrum, frequency spectrum centroid, width of the frequency spectrum energy concentration region, frequency spectrum bandwidth, and frequency domain feature vector;

[0099] Integrate the statistical feature vector, time series feature vector and frequency domain feature vector of each measurement point to form a comprehensive feature vector. If the dimension of the comprehensive feature vector is too high, use principal component analysis to reduce the dimension of the comprehensive feature vector to obtain the reduced feature vector.

[0100] According to the reduced feature vector, use K-means clustering algorithm for clustering analysis to divide different operating states into different categories to obtain the classification result of the power grid operating state.

[0101] Specifically, let's assume we have a standardized power grid operation dataset containing voltage data in volts with a time interval of 1 second for 100 seconds. To extract the feature vector, first calculate the statistical features: the voltage mean is 220 V, obtained by calculating the average of all voltage values; the voltage variance is 4 V 2 , obtained by squaring the difference between each voltage value and the mean, then averaging; the voltage maximum is 225 V, found by iterating through all voltage values; the voltage minimum is 215 V, also found by iterating. Then, extract the time series features: calculate the voltage rate of change, which is the average of the absolute values of the voltage changes per second, for example, assume the voltage changes per second are 1 V, -2 V, 1 V, 0 V,... and so on, then the rate of change is the average of the absolute values of all these changes, assume it is 5 V / s; the trend measure is obtained by calculating the linear regression slope of the voltage sequence, assume the voltage data increases over time, fit the linear equation y = kx + b, get the slope k as 1 V / s, indicating a slight upward trend in voltage. Finally, extract the frequency domain features: perform a fast Fourier transform on the voltage data to get the frequency spectrum. Assume the FFT result shows a peak at 1 Hz, then the dominant frequency is 1 Hz; the spectral centroid is the "center of gravity" of the spectrum, obtained by calculating the sum of the product of each frequency component and its amplitude, then divided by the sum of all amplitudes, assume it is 15 Hz; the spectral bandwidth is obtained by calculating the range of frequencies whose amplitudes are higher than half the maximum amplitude, assume it is 2 Hz. These features can be used for power grid fault diagnosis, for example, too large variance and too high rate of change may indicate unstable power grid, dominant frequency deviation may indicate generator failure. These features together form a feature vector describing the state of the power grid operation, which can be input into a machine learning model for further analysis and prediction. Since there is a business association between these features, for example, the voltage rate of change and the variance may both reflect the volatility of the voltage, the trend measure and the dominant frequency may both reflect the long-term stability of the power grid, therefore these features form a rigorous thought chain.

[0102] Step S3, taking the feature vector subset as a sample, training a feature anomaly identification model through an unsupervised learning algorithm, identifying the corresponding abnormal data points in the monitoring equipment through the feature anomaly identification model, and calculating the anomaly scores of the abnormal data points through a preset isolation forest algorithm, and marking the data points with anomaly scores higher than a preset anomaly score threshold as suspected abnormal points; the vector feature items include statistical feature items, time series feature items, and frequency domain feature items, the statistical feature items include mean, maximum, minimum, and variance, and the time series feature items include change rate and trend measure. The feature anomaly identification model includes corresponding verification layers with different verification conditions, the data verification accuracy and data collection frequency of each verification condition are different, the feature anomaly identification model captures the verification type features in the corresponding monitoring historical data set, matches the corresponding verification layer according to the verification type features, calls the corresponding to-be-verified data according to the verification layer, obtains the original data classes of the to-be-verified data to calculate the abnormal sub-features in the to-be-verified data according to the original data classes, calculates the abnormal deviation sub-values of the abnormal sub-features, and marks the abnormal positions of the to-be-verified data with abnormal deviation sub-values greater than a preset value as abnormal data points.

[0103] The spatial correlation and electrical correlation of the abnormal data points are calculated by the Isolation Forest algorithm, and the spatial correlation and electrical correlation are brought into the pre-constructed abnormal correlation atlas to generate abnormal correlation strength, and the abnormal sub-score is calculated according to the abnormal correlation strength, and the abnormal score of the position is calculated by the corresponding abnormal correlation weighting formula. We have a set of feature vectors that describe user transaction behavior, such as: (100, 5, 2), (150, 3, 1), (2000, 1, 1), (120, 6, 3), (180, 4, 2). These feature vectors represent, respectively. In order to identify potential abnormal transactions, we can use the Isolation Forest algorithm. First, build an isolation forest model, for example, set the number of trees to 100, and randomly select features for each tree to split, and set the maximum tree depth, such as 10. Then, the above feature vectors are used as input data to train the isolation forest model. After the model is built, the abnormal score of each data point can be calculated. For example, for data point (100, 5, 2), the model will calculate the average path length according to its path length in each tree, and calculate the abnormal score as 45 according to the formula; for data point (150, 3, 1), the abnormal score is 4; for data point (2000, 1, 1), since the transaction amount is significantly higher than other data points, and the transaction frequency and the number of locations are less, it may be isolated in a shallow path, so the abnormal score may be 85; for (120, 6, 3), the abnormal score is 48; (180, 4, 2) abnormal score is 42. Next, we need to pre-set an abnormal score threshold, for example, set it to 7. Compare the abnormal score of each data point with the threshold value, if the abnormal score of data point (2000, 1, 1) exceeds the threshold value 7, it is marked as a suspected abnormal point.

[0104] Specifically as follows:

[0105] Obtain a plurality of feature vectors, and perform data preprocessing on the plurality of feature vectors to obtain a standardized data set composed of the plurality of preprocessed feature vectors;

[0106] According to the standardized data set, an isolation forest model is constructed to obtain an initial isolation forest model;

[0107] An initial abnormal score corresponding to each data point is obtained by calculating the abnormal score of each data point in the standardized data set using the initial isolation forest model;

[0108] Compare the initial abnormal score with a pre-set abnormal score threshold value, and if the initial abnormal score is greater than the pre-set abnormal score threshold value, determine that the data point is a first type of suspected abnormal point;

[0109] Perform feature analysis on the first type of suspected abnormal point, extract the key features corresponding to the first type of suspected abnormal point, and obtain a key feature set;

[0110] According to the key feature set, similarity matching is performed in the standardized data set to obtain a normal data point set similar to the first type of suspected abnormal point;

[0111] According to the normal data point set and the first type of suspected abnormal point set, the isolation forest model is retrained to obtain an optimized isolation forest model. The optimized isolation forest model is used to calculate the anomaly scores of all abnormal data points again. If the new anomaly score still exceeds the preset anomaly score threshold, it is determined that it is a final abnormal point, and an abnormal label is performed.

[0112] The spatial correlation and electrical correlation are calculated for the suspected abnormal point. The spatial correlation is calculated based on the geographical position distance of the monitoring point, and the electrical correlation is calculated based on the electrical connection relationship of the power grid topology, including:

[0113] The geographical position coordinates of the monitoring points are obtained, and the spatial distance between any two points (i, j) is calculated using the spatial distance formula Where (x, y) is the coordinate of the monitoring point, and a spatial distance matrix is obtained.

[0114] According to the power grid topology, a node admittance matrix Y is constructed, where Yij represents the mutual admittance between nodes i and j. If nodes i and j are directly connected, the mutual admittance is calculated according to the line parameters;

[0115] If not directly connected, Yij = 0, and the electrical connection relationship between the nodes of the power grid is obtained.

[0116] For each suspected abnormal point i, a set of monitoring points Si with a spatial distance less than a preset threshold Dth is selected. If the set is empty, the spatial correlation is 0.

[0117] Otherwise, the spatial correlation Cspace(i) is calculated based on the spatial distance between each point in the set Si and the abnormal point i.

[0118] For each suspected abnormal point i, a set of nodes Ei connected to it in the power grid topology is selected. The set is obtained by breadth-first search or depth-first search algorithm. If the set is empty, the electrical correlation is 0.

[0119] Otherwise, the electrical correlation Celect(i) is calculated based on the electrical connection relationship between each point in the set Ei and the abnormal point i.

[0120] Celec(i);

[0121] The spatial correlation Cspace(i) and the electrical correlation Celec(i) are fused to obtain the comprehensive correlation Ctotal(i) = w1Cspace(i) + w2Celec(i) by weighted average or other fusion methods, where w1 and w2 are weight coefficients.

[0122] According to the obtained comprehensive correlation Ctotal(i), a threshold Cth is set, if Ctotal(i) is greater than Cth, it is considered that the abnormal point i has strong correlation with other monitoring points, and the abnormal point is greatly affected by other points; if

[0123] Ctotal(i) is less than Cth, independence determination is carried out;

[0124] According to the independence determination result, the isolated forest algorithm is used for abnormal detection on the abnormal data with strong independence, and the algorithm based on graph neural network or the algorithm based on clustering is used for abnormal detection on the abnormal data without independence, to determine the abnormal type and abnormal level.

[0125] For example, a suspected abnormal point A is monitored in a substation, and the voltage fluctuation is large. In order to analyze the abnormality, first, the spatial correlation is calculated, assuming that there are B and C monitoring points in the substation, the coordinates of A point are (113, 39), the coordinates of B point are (11301, 3901), and the coordinates of C point are (11299, 3899), the unit is longitude and latitude. The spatial correlation is calculated by using the inverse distance weighting method, the weight is inversely proportional to the square of the distance, that is, wij=1 / dij 2 , dij is the spherical distance between two points, which can be calculated by using the Haversine formula:

[0126]

[0127] Where r is the radius of the earth, φ is the latitude, and λ is the longitude. The distance between A and B is about 141 km, and the distance between A and C is about 141 km, so the spatial correlation weight wAB between A and B is 1 / 141 2 ≈518, and the spatial correlation weight wAC between A and C is 1 / 141 2 ≈518. Then the electrical correlation is analyzed, assuming that in the power grid topology, A point is connected to bus M1, B point is also connected to bus M1, and C point is connected to bus M2, M1 and

[0128] M2 is connected through transformer T1. Define the electrical distance: the electrical distance between two points on the same bus is 1, and the electrical distance between points on two buses connected by a transformer is 2. Then the electrical distance between A and B is 1, and the electrical distance between A and C is 2. Using the reciprocal of the electrical distance as the electrical correlation weight, the electrical correlation weight between A and B eAB = 1 / 1 = 1, and the electrical correlation weight between A and C eAC = 1 / 2 = 5. Considering the spatial and electrical correlation, the voltage data of monitoring points B and C can be more comprehensively evaluated for the reference value of analyzing the anomaly of point A. For example, the spatial correlation and electrical correlation weights can be weighted and averaged to obtain the comprehensive correlation, for example, the spatial weight accounts for 4 and the electrical weight accounts for 6, then the comprehensive correlation between A and B is 4*518+6*1 = 2672, and the comprehensive correlation between A and C is 4*518+6*5 = 2372. Therefore, the reference value of B point data for analyzing the anomaly of A point is slightly higher than that of C point.

[0129] The abnormal correlation graph is constructed, the nodes of the abnormal correlation graph are power grid devices or monitoring points, the edges of the abnormal correlation graph are the correlation relationship strengths between the nodes, and the correlation relationship strengths fuse the spatial correlation values and the electrical correlation values, including:

[0130] Obtain power grid topology graph data, and extract device point information representing generators, transformers, buses and transmission lines from the power grid topology graph data;

[0131] At the same time, obtain monitoring point information in the supervisory control and data acquisition system, and obtain voltage level and current value data corresponding to each monitoring point;

[0132] According to the geographic map data, obtain spatial distance information of the device points and the monitoring points;

[0133] According to the spatial distance information between the device points and the monitoring points, calculate the spatial correlation values, and the smaller the spatial distance, the greater the spatial correlation value;

[0134] If the spatial distance is greater than a preset spatial distance threshold, the spatial correlation value is set to zero;

[0135] Obtain protection state information and fault state information;

[0136] If at least one of the two nodes is in a protection state or a fault state, the probability of electrical connection between the two nodes increases;

[0137] According to the size of the probability increase, determine the increase amplitude of the electrical correlation value;

[0138] According to the line number and substation information, determine whether the two nodes are directly connected through a line or located in the same substation;

[0139] If two nodes are directly connected or located in the same substation, the electrical correlation value increases;

[0140] If two nodes are not directly connected or located in the same substation, the electrical distance between the nodes is obtained according to the power flow calculation, and the smaller the electrical distance, the greater the electrical correlation value;

[0141] The spatial correlation value and the electrical correlation value are fused to obtain the association relationship strength between the nodes;

[0142] If the spatial correlation value or the electrical correlation value between two nodes is zero, the association relationship strength is zero;

[0143] If the spatial correlation value and the electrical correlation value between two nodes are not zero, the association relationship strength is the weighted sum of the spatial correlation value and the electrical correlation value;

[0144] According to the association relationship strength between all nodes, an adjacency matrix is constructed;

[0145] The element value in the adjacency matrix is the association relationship strength between the corresponding nodes;

[0146] If the association relationship strength is less than a preset association relationship strength threshold, the corresponding element value in the adjacency matrix is set to zero;

[0147] According to the adjacency matrix, an abnormal power grid association graph is generated;

[0148] The nodes in the graph are device points and monitoring points, and the edges in the graph are the association relationships between the nodes;

[0149] If the corresponding element value in the adjacency matrix is zero, there is no edge between the two nodes;

[0150] If the corresponding element value in the adjacency matrix is not zero, there is an edge between the two nodes, and the weight of the edge is the association degree.

[0151] To construct the abnormal power grid association graph, the geographic location coordinates of the power grid devices and monitoring points can be obtained through a geographic information system, for example, transformer A coordinate (114, 39), circuit breaker B coordinate (1145, 395), and line C connecting A and B. The spatial distance between the nodes is calculated using the Euclidean distance formula: A spatial distance threshold, for example 1, is set, and node pairs less than the threshold are considered to have spatial correlation. The spatial correlation value can be determined inversely according to the distance, for example, the correlation value = 1 / (1+d) = 1 / (1+071)≈934. At the same time, the electrical connection relationship is extracted from the power grid topology database. For example, transformer A is connected to circuit breaker B through line C, and A and B have a direct electrical connection. For node pairs with direct electrical connection, the electrical correlation value is set to 1; for node pairs connected indirectly through multiple devices, the electrical correlation value can be obtained through power flow calculation. For example, assume that the active power transmission between A and B is 100 MW through power flow calculation, and the total load of A is 200 MW, then the electrical correlation value between A and B can be defined as 100 / 200 = 5. To ensure that the spatial correlation and electrical correlation values are in the same dimension, the electrical correlation can be normalized, for example, the maximum value is 1, and the minimum value is controlled by setting a threshold, and the value less than the threshold is zero. Finally, the spatial correlation and electrical correlation values are fused, and a weighted average method is used: correlation strength = 6

[0152] 934+4*5=7604. The weight coefficients 6 and 4 can be adjusted according to actual application scenarios, indicating the relative importance of spatial correlation and electrical correlation. In this way, an abnormal association graph containing nodes such as transformer A, circuit breaker B and line C is constructed, and the edges have correlation strengths. This correlation strength value can be used for subsequent abnormal propagation analysis, fault location and other applications.

[0153] Step S4, the suspected abnormal point is input into a graph neural network to construct an abnormal propagation model; the graph neural network includes a plurality of abnormal points, each abnormal point is provided with a plurality of abnormal point items, each abnormal point corresponds to a corresponding monitoring device, the abnormal point item corresponds to an abnormal type, and the abnormal point items are connected through a graph network line. When any two abnormal point items have the same event triggering feature, the corresponding graph network line is corrected according to the event triggering feature to construct the graph neural network. When any continuous network path in the graph neural network meets the preset triggering constraint condition, the corresponding network path is taken as an abnormal event propagation path to construct the abnormal propagation model. The abnormal propagation model includes a plurality of abnormal event propagation paths, and each abnormal event propagation path includes a plurality of abnormal point items and a point item association line in a triggering state.

[0154] The abnormal event propagation path and influence range are modeled by using a graph neural network, nodes of the graph neural network are power grid devices or monitoring points, edges of the graph neural network are association relationships between devices or monitoring points, the association relationships integrate spatial and electrical connection relationships, node features of the graph neural network are the plurality of feature vectors, a propagation rule of the abnormality in the power grid is learned through a message passing mechanism of the graph neural network, and an abnormal propagation model is obtained, including:

[0155] Multi-dimensional feature vectors of power grid devices and monitoring points are collected, spatial geographic position information and electrical topology connection information of the devices are integrated, a power grid association relationship matrix is constructed, and initial node features and edges of the graph neural network are obtained;

[0156] An adjacency matrix A of the graph neural network is constructed according to the power grid association relationship matrix, where Aij represents whether there is a connection relationship between node i and node j, if there is a connection, the value of Aij is 1, otherwise 0;

[0157] The adjacency matrix A and the node feature matrix X are input into the graph neural network, graph convolution operations are used to update the feature vectors of each node, and new node feature vectors that integrate neighborhood node information are obtained;

[0158] According to the updated node feature vectors, attention weights between nodes are calculated by using an attention mechanism, the attention weights reflect the importance difference of different neighbor nodes to the current node, and weighted node features are obtained;

[0159] The weighted node features are obtained, and multi-layer graph neural networks are used for iterative calculation, each layer of the graph neural network performs message passing and node feature updating operations, and a deep fused node feature expression is obtained;

[0160] According to the deep fused node feature expression, a propagation probability of the abnormal event is predicted by using an output layer of the graph neural network, if the propagation probability of a certain node exceeds a preset threshold, the node is determined as a node affected by the abnormality;

[0161] All nodes determined to be affected by the abnormality are obtained, the propagation path and the influence range of the abnormal event are determined according to the connection relationship between the nodes, and a propagation model of the power grid abnormal event is obtained.

[0162] The abnormal propagation model further includes a propagation rule mirroring strategy, the propagation rule mirroring strategy calculates a similarity of abnormal event transmission paths, when the similarity of any abnormal event transmission path is greater than a preset convergence condition, a propagation rule is generated according to the abnormal event transmission path, and an additive trigger value is generated according to the propagation rule, when the features of the graph neural network meet the propagation rule, the corresponding network path is given with the additive trigger value to meet the corresponding trigger constraint condition.

[0163] Step S5, monitoring the corresponding monitoring device of the power grid through the abnormal propagation model.

[0164] The abnormal propagation rule output based on the abnormal propagation model is used to generate an abnormal triggering condition, and the corresponding power grid device or monitoring point is monitored in real time. If the abnormal triggering condition is met, a comprehensive abnormal event is generated, including:

[0165] Real-time data streams of power grid devices and monitoring points are obtained, and through data preprocessing, multi-dimensional power grid data containing time series and spatial location information are formed;

[0166] According to the pre-established abnormal propagation model, the multi-dimensional power grid data is analyzed to obtain the abnormal propagation rule between different devices and monitoring points, and the key features are extracted;

[0167] Based on the extracted key features and abnormal propagation rules, an abnormal triggering condition rule base is constructed, and each rule contains multiple judgment conditions and corresponding event levels;

[0168] Using real-time data streams, the triggering conditions in the rule base are continuously matched. If the monitored power grid data meets all the judgment conditions of a rule, the corresponding abnormal event is triggered;

[0169] For multiple single-point abnormal events triggered, it is judged whether there is correlation according to the abnormal propagation rule and the spatial location relationship, and event fusion is performed;

[0170] Using a decision tree algorithm, the type, level and spatio-temporal correlation of multiple single-point abnormal events are comprehensively analyzed to determine whether they need to be fused into a comprehensive abnormal event;

[0171] If the decision tree algorithm determines that fusion is needed, a comprehensive abnormal event record containing multiple single-point abnormal event information is generated, and the record contains the power grid data and attribute information of all associated single-point abnormal events. The power grid fault knowledge base stores fault patterns and their feature vectors, and the comprehensive abnormal event is "voltage fluctuation in a certain area, part of the line current increases, the relay protection device sends a trip signal, and the supervisory control and data acquisition system records multiple switch trips". First, the features of the comprehensive abnormal event are extracted, such as voltage fluctuation amplitude of 15%, current increase amplitude of 20%, and trip switch number of 3, which are quantized as a vector X = [15, 20, 3]. Then, the cosine similarity algorithm is used to calculate the similarity between the abnormal event feature vector X and all fault patterns in the knowledge base. For example, there is a fault pattern "line overload" in the knowledge base, and its feature vector Y = [10, 25, 2], then the cosine similarity between X and Y is calculated: similarity(X, Y) = (15*10 + 20*25 + 3*2) / (sqrt(15 2 +202 +3 2 )\*sqrt(10 2 +25 2 +2 2 The similarity score is approximately 98. Assuming a preset fault mode similarity threshold of 9, since 98 is greater than 9, the abnormal event is determined to be highly similar to the "line overload" fault mode. To ensure the integrity of the thought process and to link it to business operations, alarm information is pushed. The diagnostic results are associated with relevant responsible personnel information. If all calculated similarities are below the threshold of 9, it is considered that there is no matching fault mode in the knowledge base. In this case, the system marks the abnormal event as a "new type of fault" and stores its feature vector X in the knowledge base as a reference for future fault diagnosis. Simultaneously, the system triggers expert system intervention for analysis and sends the analysis request and event feature vector X to the expert system interface.

[0172] Furthermore, response strategies can be optimized based on anomaly diagnosis results: A power grid fault knowledge base is constructed to store known fault modes and their characteristics, causes, and handling solutions; a historical fault case library is constructed to store historical fault event records, which include anomaly characteristics, power grid topology, occurrence time, and handling solutions, including:

[0173] The power grid topology structure data stored in the historical fault case library and the corresponding case abnormal feature data are acquired, and the graph-structured power grid topology correlation information is obtained by graph-structured processing of the power grid topology structure data. It is assumed that the historical fault case library has been preprocessed by a fault mode recognition algorithm. If the system determines that the similarity of the current abnormal event and the existing cases in the library is less than 70%, the system starts the similar case retrieval. First, the system extracts the feature vector of the current abnormal event, for example: the abnormal voltage fluctuation amplitude is 15%, the frequency deviation is 2 Hz, the 110 kV line L1 of the substation A is involved, the power grid topology structure is ring network power supply, and the occurrence time is May 16, 2024, 23:30. Then, the distance between the feature vector and the feature vector of each case in the historical case library is calculated, and the cosine similarity algorithm is used, for example, the cosine similarity with case B is 65, and the cosine similarity with case C is 68. Case B records that the voltage fluctuation of the 220 kV line L2 of substation B is 12%, the frequency deviation is 15 Hz, the power grid topology is radial power supply, the occurrence time is December 1, 2023, 18:00, and case C records that the voltage fluctuation of the 110 kV line L3 of substation A is 18%, the frequency deviation is 25 Hz, the power grid topology structure is ring network power supply, and the occurrence time is January 10, 2024, 22:10. Then, further evaluation is performed, and the similarity is weighted. The abnormal feature similarity weight is 5, the power grid topology structure similarity weight is 3, and the occurrence time similarity weight is 2. For case B, the comprehensive similarity score is 65*5+2*3+1*2=405, and for case C, the comprehensive similarity score is 68*5+1*3+8*2=8. Case C is selected because the comprehensive similarity is higher. The disposal scheme of case C is: "adjust the active output of the generator set, increase the reactive power compensation capacity, and check the line protection device". The system combines the current abnormal event data to adjust the disposal scheme to: "increase the active output of the generator set G1 by 50 MW, put the reactive power compensation device M1 into operation, increase the reactive power compensation capacity by 10 MVar, and check the line protection device of the 110 kV line L1 of substation A", and generates the final emergency disposal suggestion. In order to form a thinking chain, after generating the emergency disposal suggestion, the disposal suggestion is immediately sent to the related execution system, and the execution result is tracked and fed back to the historical fault case library to update the case information and form a closed-loop management.

[0174] The graph-structured power grid topology correlation information and the case abnormal feature data are acquired, and the fusion feature vector is obtained by feature fusion processing. The fusion feature vector includes power grid topology structure information and abnormal feature information.

[0175] The fusion feature vector is acquired, and the fusion feature vector is analyzed by an unsupervised clustering algorithm to obtain a plurality of clustering clusters. Each clustering cluster represents a potential fault mode.

[0176] obtaining a plurality of clustering clusters, for each clustering cluster, extracting its corresponding fault feature and fault cause and historical scheme, constructing a fault mode knowledge item, and obtaining a fault mode knowledge item set;

[0177] obtaining the fault mode knowledge item set, using database technology for structured storage, constructing a power grid fault knowledge base, and the power grid fault knowledge base containing known fault modes, characteristics, causes and disposal schemes thereof;

[0178] obtaining real-time collected power grid operation data, extracting abnormal feature data from the real-time collected power grid operation data, and if the abnormal feature data meets a preset fault judgment threshold, performing fault mode matching from the power grid fault knowledge base;

[0179] performing fault mode matching from the power grid fault knowledge base, and if a similar fault mode is matched, extracting a disposal scheme corresponding to the matched similar fault mode;

[0180] performing fault processing according to the extracted disposal scheme. According to the comprehensive abnormal event, the power grid fault knowledge base is combined to infer an abnormal event type and a cause, a fault mode similarity is calculated, and if there is a fault mode similarity exceeding a preset fault mode similarity threshold, a fault diagnosis result is output, including:

[0181] obtaining detailed data information of a comprehensive abnormal event, calling historical fault data from the power grid fault knowledge base, and forming a fault feature vector set;

[0182] performing feature extraction and dimension reduction processing on the feature vector of the comprehensive abnormal event to obtain a simplified feature vector set;

[0183] According to the simplified feature vector set, matching is performed with the known fault mode feature vector set in the power grid fault knowledge base, and the similarity between the vectors is calculated;

[0184] If there is at least one fault mode similarity exceeding a preset fault mode similarity threshold, the fault mode with the highest similarity is output as a preliminary diagnosis result;

[0185] According to the preliminary diagnosis result, information fusion is performed on the power grid operation state data at the time of occurrence of the comprehensive abnormal event to obtain fused comprehensive information;

[0186] According to the fused comprehensive information, a decision tree algorithm is used to evaluate the credibility of the preliminary diagnosis result to obtain a credibility evaluation result;

[0187] If the credibility evaluation result is higher than a preset credibility threshold, the preliminary diagnosis result is output as a final fault diagnosis result;

[0188] If the credibility evaluation result is lower than the preset credibility threshold, go back to the third step, use support vector machine or random forest algorithm to recalculate the similarity. If there is no high similarity fault mode, retrieve similar cases from the historical fault case library, evaluate the similarity of abnormal features, power grid topology, occurrence time, generate emergency treatment suggestions based on the treatment scheme of similar cases, combined with the current abnormal event data, including:

[0189] Get the fault mode set of all cases in the historical fault case library, calculate the similarity of the fault mode of the current abnormal event and the historical fault mode, judge whether there is a high similarity fault mode, if there is no high similarity fault mode, go to the next step;

[0190] Retrieve the case set with similarity higher than the preset threshold from the historical fault case library, extract the abnormal feature vector, power grid topology graph and fault occurrence time stamp of the case for these similar cases;

[0191] Get the abnormal feature vector of the current abnormal event, the current power grid topology graph and the current time stamp, respectively calculate the similarity of the current abnormal event and each historical similar case in abnormal features, power grid topology and occurrence time;

[0192] According to the similarity of abnormal features, power grid topology and occurrence time, comprehensively evaluate the overall similarity of the current abnormal event and each historical similar case;

[0193] Get the treatment scheme set corresponding to the several historical similar cases with the highest overall similarity from the historical fault case library;

[0194] Get the real-time monitoring data stream of the current abnormal event, use the pre-trained abnormal event classification model to determine the subcategory to which the current abnormal event belongs according to the real-time monitoring data stream;

[0195] According to the subcategory to which the current abnormal event belongs and the treatment scheme set of the historical similar cases with the highest overall similarity, combined with the current real-time monitoring data stream, use rule engine or LSTM and GRU and other recurrent neural network algorithms to generate emergency treatment suggestion sequence of the current abnormal event.

[0196] The power grid fault knowledge base and the historical fault case base can be fused and processed in the following manner: first, the fault mode knowledge base can be stored in RDF triples, for example: line L1 overload, performance characteristics, current exceeds rated value 120%, line L1 overload, reason, downstream transformer B1 fault, line L1 overload, disposal scheme, shift load to line L2. Among them, "line L1 overload" is the subject, "performance characteristics", "reason" and "disposal scheme" are the predicate, and the specific description is "current exceeds rated value 120%" and the like as the object. Feature extraction can use wavelet transform to analyze the current waveform, and set a threshold, such as determining that the total harmonic distortion of the current harmonic exceeds 5% as a harmonic exceeding characteristic. Reason analysis can combine Bayesian networks, input multiple characteristics, and calculate the posterior probability of each fault reason through probability reasoning, for example, if the current exceeds 120% and the temperature sensor shows 80°C, the Bayesian network calculates that the transformer B1 fault probability is 85 and the line L1 overload probability is 1. The disposal scheme is based on pre-set rules, such as IF-THEN rules: IF line L1 overload

[0197] AND line L2 load rate is less than 70% THEN shift load to line L2. The historical fault case base is stored in a relational database, and each record contains fields: fault ID, abnormal characteristics, power grid topology: graph database Neo4j stores the relationship between nodes and edges, for example, line L1 connects substation A and substation B, occurrence time: timestamp format, such as 2024-07-24 10:30:00, disposal scheme: text description, such as "load transfer has been performed". When a new fault occurs, its abnormal characteristics are extracted, and K- nearest neighbor algorithm is used to search similar cases in the historical case base, for example, the Euclidean distance between the new fault feature vector and the historical case feature vector is calculated, and the K closest cases are selected, and the disposal scheme is referred to. At the same time, the new fault case and its disposal result are also updated to the historical case base, realizing the self-learning and improvement of the knowledge base. In this way, the two databases are connected to form an organic whole.

[0198] A kind of low-voltage power grid abnormal trigger linkage abnormal analysis system, configure the linkage abnormal analysis method of low-voltage power grid abnormal trigger of any one described above, including data acquisition module, data standardization module, feature extraction module, abnormal identification module, abnormal propagation modeling module and abnormal trigger and comprehensive module;

[0199] The data acquisition module is used to acquire real-time data streams from different monitoring devices;For acquiring real-time data streams generated by monitoring devices at each link of the power grid, the real-time data streams include voltage, current, power, frequency data, environmental and load data;

[0200] The data standardization module is configured to process real-time data streams, implement standardization processing on the real-time data streams of different sources and different formats, unify time granularity and data format, scale the real-time data streams to a preset interval by using a normalization method, and convert the real-time data streams into a distribution with a mean value of 0 and a standard deviation of 1 by using a Z-score standardization method, thereby forming a standardized power grid operation data set.

[0201] The feature extraction module is configured to extract feature vectors corresponding to data streams in the corresponding historical data set, and extract a plurality of feature vectors reflecting power grid operation states from the standardized power grid operation data set, wherein the plurality of feature vectors include statistical feature vectors, time series feature vectors and frequency domain feature vectors, the statistical feature vectors contain mean, variance, maximum value and minimum value, the time series feature vectors contain change rate and trend measure, and the frequency domain feature vectors contain main frequency, spectral centroid and spectral bandwidth.

[0202] The anomaly identification module is configured to identify suspected abnormal points in the corresponding historical data set, and the anomaly identification module includes an unsupervised anomaly detection module, a correlation calculation module and an abnormal correlation graph construction module.

[0203] The abnormal propagation modeling module is configured to construct an abnormal propagation model according to suspected abnormal points; for the plurality of feature vectors, identify potential abnormal data points by using an unsupervised anomaly detection algorithm, calculate an anomaly score of each data point by using an isolation forest algorithm, and mark a data point with an anomaly score exceeding a preset anomaly score threshold as a suspected abnormal point; for the suspected abnormal points, calculate spatial correlation and electrical correlation, the spatial correlation is calculated based on geographic location distance of monitoring points, and the electrical correlation is calculated based on electrical connection relationship of a power grid topology; construct an abnormal association graph, nodes of the abnormal association graph are power grid equipment or monitoring points, and an edge of the abnormal association graph is an association relationship strength between nodes, the association relationship strength fuses a spatial correlation value and an electrical correlation value; model an abnormal event propagation path and an influence range by using a graph neural network, nodes of the graph neural network are power grid equipment or monitoring points, an edge of the graph neural network is an association relationship between equipment or monitoring points, the association relationship fuses spatial and electrical connection relationships, and node features of the graph neural network are the plurality of feature vectors; by using a message passing mechanism of the graph neural network, learn a propagation rule of an abnormality in a power grid, and obtain an abnormal propagation model; it is assumed that the power grid includes five nodes, respectively representing a transformer T1, a bus B1, a line L1, a line L2, and a load F1. A node feature vector includes a voltage amplitude, a phase angle, an active power, and a reactive power, and initial time characteristics of each node are as follows: T1(05, 0, 10, 2), B1(02, -1, 8, 5), L1(0, -2, 6, 1), L2(98, -3, 4, 5), and F1(95, -4, -10, -2). An association relationship between nodes is represented by an adjacency matrix A, where A[i][j] = 1 indicates that nodes i and j are directly connected, otherwise 0, and A = [[0, 1, 0, 0, 0], [1, 0, 1, 1, 0], [0, 1, 0, 0, 1], [0, 1, 0, 0, 1], [0, 0, 1, 1, 0]] considering spatial and electrical connections. A graph convolution network (GCN) is used as a graph neural network model, and a message passing mechanism of the GCN can be represented as: wherein represents a feature vector of node i at the lth layer, N(i) represents a neighbor node set of node i, d i represents a degree of node i, that is, a number of connected edges, W l and b lis the weight matrix and bias vector of the first layer, and σ is the activation function, which is ReLU in this paper. Assuming there is only one layer of GCN, the weight matrix W is [[1, 2, 3, 4], [2, 3, 4, 1], [3, 4, 1, 2], [4, 1, 2, 3]], and the bias vector b is [1, 0, -1, 2]. At the initial moment, assume that the L2 line fails, and its active power and reactive power suddenly become 0, the voltage amplitude decreases to 8, and the phase angle becomes -10, that is, L2 becomes (8, -10, 0, 0). This fault information is taken as the input, and the GCN is used for one message passing to update the features of each node. For example, for node B1, its neighbor nodes are T1, L1, and L2, and the degree is 3. First, calculate the normalization coefficient: the degree of T1 is 1, the degree of L1 is 2, and the degree of L2 is 2, so the corresponding normalization coefficients are Then, weighted summation is performed: Substitute the specific numerical values to obtain a 4-dimensional vector, then add the bias vector b, and finally pass it through the ReLU activation function to obtain the updated B1 node feature vector. Similarly, update the features of other nodes. Repeat this process multiple times to simulate the propagation of anomalies in the power grid, and the converged node feature vector reflects the influence range of the anomaly. By analyzing the changes in the feature vectors of each node, the propagation path and influence range of the anomaly can be evaluated.

[0204] The abnormal trigger and synthesis module is used to supervise the acquired real-time data stream by an abnormal identification model to generate an abnormal result. For example, the abnormal propagation rule output by the power grid abnormal propagation model is: when the voltage fluctuation of monitoring point A exceeds 10% and the duration exceeds 5 seconds, and the current of monitoring point B adjacent to A increases by more than 15%, it is considered that the abnormality is propagated from A to B. Based on this rule, we can construct the abnormal trigger condition. The specific implementation method is: real-time acquisition of voltage data of monitoring point A, and calculation of voltage fluctuation percentage in every 5 seconds by using a sliding window algorithm. Assuming that the voltage values in the last 5 seconds are: 245V, 248V, 242V, 250V, and 247V, the maximum fluctuation percentage is (250-220) / 220*100%=164%, which exceeds 10%. At the same time, the program continuously monitors the duration of voltage fluctuation exceeding 10%. If the duration counter reaches 5 seconds, the first trigger condition is met. At the same time, the system acquires the current data of monitoring point B in parallel, and calculates the current increase percentage in every 5 seconds by using the sliding window algorithm. Assuming that the current values of monitoring point B in the same period as the voltage fluctuation exceeding the limit for 5 seconds are: 116A, 118A, 117A, 119A, and 120A, the maximum increase percentage is (120-100) / 100*100%=20%, which exceeds 15%, and the second trigger condition is met. When both trigger conditions are met, the system immediately generates a comprehensive abnormal event, records the event occurrence time, involved monitoring points, abnormal type and related values. This record will be stored in the database and trigger an alarm to notify the relevant maintenance personnel. Since the generation of the abnormal event is completely based on real-time data stream and preset rules, the whole process does not require human intervention and can be automatically completed by the program. In order to form a thinking chain, the comprehensive abnormal event can be associated with the equipment account, for example, monitoring points A and B correspond to the low voltage side of transformer T1 and feeder F1 respectively, so the comprehensive abnormal event is directly associated with transformer T1 and feeder F1, which facilitates subsequent fault location and equipment maintenance.

[0205] The abnormal trigger and synthesis module can also be included, which is used to generate abnormal trigger conditions based on the abnormal propagation rule output by the abnormal propagation model, and to monitor the corresponding power grid equipment or monitoring points in real time. If the abnormal trigger condition is met, a comprehensive abnormal event is generated.

[0206] The fault knowledge base and case base construction module is used to construct a power grid fault knowledge base, store known fault modes and their characteristics, causes and disposal schemes, and construct a historical fault case base to store historical fault event records, which include abnormal characteristics, power grid topology structure, occurrence time and disposal scheme.

[0207] a fault diagnosis module configured to infer an abnormal event type and a cause in combination with the power grid fault knowledge base for the comprehensive abnormal event, calculate a fault mode similarity, and output a fault diagnosis result if there is a fault mode similarity exceeding a preset fault mode similarity threshold;

[0208] an emergency treatment suggestion generation module configured to retrieve similar cases from the historical fault case library if there is no high similarity fault mode, evaluate a similarity of abnormal features, a power grid topology structure, and an occurrence time, and generate an emergency treatment suggestion in combination with a current abnormal event data based on a treatment scheme of the similar cases.

[0209] It is apparent for those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, but can be implemented in other concrete forms without departing from the spirit or essential characteristics of the present application. Therefore, the embodiments should be considered in all respects as illustrative and not restrictive, the scope of the present application being defined by the appended claims rather than the above description, and it is intended to embrace all changes and modifications that fall within the meaning and scope of equivalents of the claims. Any reference signs in the claims should not be construed as limiting the claims to which they belong.

Claims

1. A method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids, characterized in that, Step S1: Obtain monitoring information from the monitoring equipment and process the monitoring information according to a preset format coordination strategy to generate a standardized power grid dataset; Step S2: Extract feature vectors from the standardized power grid dataset using a preset multi-dimensional vector feature extraction strategy to generate a feature vector subset corresponding to each monitoring device; Step S3: Using a subset of feature vectors as samples, train a feature anomaly recognition model using an unsupervised learning algorithm. Use the feature anomaly recognition model to identify the corresponding abnormal data points in the monitoring equipment. Calculate the anomaly score of the abnormal data points using a preset isolated forest algorithm. Mark data points with anomaly scores higher than a preset anomaly score threshold as suspected anomalies. Step S4: Input suspected anomalies into a graph neural network to construct an anomaly propagation model; Step S5: Monitor the power grid corresponding monitoring equipment through the anomaly propagation model.

2. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 1, characterized in that: Step S1 further includes a preprocessing sub-strategy, which includes... Step S11: Obtain multi-source heterogeneous real-time data streams. By parsing the protocols and data structures of different data sources, determine the format and type of the original data streams. Step S12: According to the predefined same time standard, perform time alignment on real-time data streams from different sources. If the timestamp of the original data stream is abnormal, obtain the prediction data at the corresponding time through the preset data completion sub-strategy. Step S13: Process the data stream using a preset standard format to obtain a standard format data stream; Step S14: Normalize the data of the corresponding standard format data stream by using a preset normalization standard; Step S15: Perform Z-score standardization on the normalized data to obtain standard scores with a mean of 0 and a standard deviation of 1, and filter the standard score data that conforms to a normal distribution. Step S16: Construct the corresponding power grid operation dataset based on the standard score data.

3. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 2, characterized in that: The data completion sub-strategies include: Step S121: Obtain the data streams uploaded by each power grid monitoring device, which include real-time voltage, real-time current, real-time power, and real-time frequency; Step S122: Obtain the ambient temperature and humidity data reported by the environmental monitoring equipment, determine the environmental dataset of each node of the power grid by associating the data source with the attributes of the power grid nodes, and merge the power grid operation dataset to obtain a holographic dataset of the power grid status that includes environmental factors. Step S123: According to the load level, classify the holographic dataset of power grid status, establish datasets under different load levels, and determine the normal fluctuation range of voltage, current, power and frequency under different load levels; Step S124: Construct an event dynamic case model from historical power grid operation data. The event dynamic case model reflects the change constraints of each data point under the corresponding event scenario. Step S125: Obtain the event scenario corresponding to the target time period of the missing data, retrieve the corresponding change constraints from the event dynamic case model according to the event scenario, and calculate the corresponding missing data through the change constraints and known data.

4. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 1, characterized in that: The multidimensional vector feature extraction strategy includes Step S21: Obtain the base data type of the corresponding data, and retrieve the vector construction group from the pre-built vector type table according to the base data type. Each vector construction group includes several different vector feature items. Step S22: Calculate the feature vectors of the corresponding data under different vector feature terms; Step S23: Integrate the feature vectors through the integration and correction sub-strategy to generate a comprehensive feature vector; Step S24: Perform cluster analysis on the comprehensive feature vectors for each time period to obtain the corresponding clusters, and label the corresponding comprehensive feature vectors according to the cluster type to generate the feature vector subset.

5. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 4, characterized in that: The vector feature terms include statistical feature terms, time-series feature terms, and frequency domain feature terms. The statistical feature terms include mean, maximum value, minimum value, and variance. The time-series feature terms include rate of change and trend measure.

6. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 1, characterized in that: The feature anomaly identification model includes corresponding verification layers with different verification conditions. Each verification condition has different data verification accuracy and data acquisition frequency. The feature anomaly identification model captures verification type features in the corresponding historical monitoring dataset, matches the corresponding verification layer according to the verification type features, retrieves the corresponding data to be verified according to the verification layer, obtains the original data class of the data to be verified, calculates the abnormal sub-features in the data to be verified based on the original data class, calculates the abnormal deviation sub-value of the abnormal sub-features, and marks the abnormal position of the data to be verified with an abnormal deviation sub-value greater than a preset value as an abnormal data point.

7. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 6, characterized in that: The spatial and electrical correlations of the anomalous data points are calculated using the isolated forest algorithm. These correlations are then input into a pre-constructed anomalous correlation map to generate anomaly correlation strength. Anomaly sub-scores are calculated based on the anomalous correlation strengths, and the anomalous score at that location is calculated using the corresponding anomalous correlation weighting formula.

8. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 1, characterized in that: The graph neural network includes several anomaly points, each with several anomaly point items. Each anomaly point corresponds to a corresponding monitoring device, and each anomaly point item corresponds to an anomaly type. The anomaly point items are connected by graph network lines. When any two anomaly point items have the same event triggering characteristics, the corresponding graph network connection is modified according to the event triggering characteristics to construct the graph neural network. When any continuous network path in the graph neural network meets the preset triggering constraint conditions, the corresponding network path is used as the anomaly event propagation path to construct the anomaly propagation model. The anomaly propagation model includes several anomaly event propagation paths, and each anomaly event propagation path includes several anomaly point items and trigger-state point item association lines.

9. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 8, characterized in that: The anomaly propagation model also includes a propagation law mirroring strategy. The propagation law mirroring strategy calculates the similarity of the transmission paths of anomalies. When the similarity of any anomaly transmission path is greater than a preset convergence condition, a propagation law is generated based on the anomaly transmission path, and an additive trigger value is generated based on the propagation law. When the features of the graph neural network conform to the propagation law, the corresponding network path is given an additive trigger value to satisfy the corresponding trigger constraint condition.

10. A linkage anomaly analysis system for medium- and low-voltage power grid anomaly triggering, configured with a linkage anomaly analysis method for medium- and low-voltage power grid anomaly triggering as described in any one of claims 1-9, characterized in that: It includes a data acquisition module, a data standardization module, a feature extraction module, an anomaly identification module, an anomaly propagation modeling module, and an anomaly triggering and synthesis module; The data acquisition module is used to acquire real-time data streams from different monitoring devices; The data standardization module is used to process real-time data streams; The feature extraction module is used to extract the feature vectors corresponding to the data stream in the corresponding historical dataset; The anomaly identification module is used to identify suspected anomalies in the corresponding historical dataset. The anomaly propagation modeling module is used to construct an anomaly propagation model based on suspected anomalies. The anomaly triggering and integration module is used to generate anomaly results by supervising the real-time data stream obtained through the anomaly identification model.

Images