A method and system for analyzing abnormal linkage triggered by abnormality of a medium and low voltage power grid

Abstract

The application provides a linkage abnormality analysis method and system triggered by an abnormality of a medium and low voltage power grid, data points in different types are obtained through storage and feature extraction of data streams, and an association relationship between different devices and different types of data is constructed, different abnormality standards in each type are quantified through establishment of a feature vector association relationship, and corresponding suspected abnormal points are evaluated as secondary training samples according to the association relationship, so as to construct an abnormality propagation model, avoid interference of useless data on construction of the abnormality propagation model, and adjust and optimize the abnormality propagation model generated by the suspected abnormal points through construction of the association relationship according to changes of a scene and use, thereby improving system reliability and timeliness and accuracy of abnormality discovery.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a method and system for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids. Background Technology

[0002] Background of the problem: A key technical challenge in power grid anomaly analysis is accurately and comprehensively identifying and locating anomalies from massive amounts of monitoring data. The power grid covers a wide area, involving many stages such as power generation, transmission, substation, distribution, and consumption. Each stage is equipped with numerous monitoring devices, generating vast amounts of diverse real-time monitoring data. Anomaly judgment requires comprehensive consideration of changes in various electrical parameters such as voltage, current, power, and frequency, as well as the influence of external factors such as weather and load. Relying solely on data from a single indicator or a few key measuring points makes it difficult to assess the severity and scope of an event.

[0003] Furthermore, the power grid's topology is intricate and complex, with multiple coupling relationships between different regions and devices. Local anomalies can spread rapidly, triggering chain reactions and causing widespread power outages or equipment damage. Signs of global anomalies may be hidden within multiple scattered local anomaly signals, and only when subtle anomalies accumulate to a certain extent will an accident be triggered. The real-time processing and correlation analysis of massive amounts of heterogeneous data also place extremely high demands on the generalization ability and adaptability of anomaly identification models.

[0004] Accurately determining the time, location, and severity of anomalies, comprehensively assessing the impact and development trend of accidents, and uncovering the correlations and propagation patterns between anomalies are pressing challenges for intelligent power grid anomaly analysis technology. This requires deep integration of knowledge from multiple disciplines, including power physics models, big data analysis, and artificial intelligence, balancing model complexity and real-time performance. While ensuring the accuracy and comprehensiveness of the analysis, it is crucial to minimize computational overhead and provide reliable support for operational applications such as monitoring and dispatching, and emergency response. Summary of the Invention

[0005] The purpose of this invention is to provide an automated anomaly identification method and system that is based on data analysis and training of the propagation law of power grid anomalies and can comprehensively analyze and judge multiple anomaly details.

[0006] This invention provides a method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids. Step S1: Obtain monitoring information from the monitoring equipment and process the monitoring information according to a preset format coordination strategy to generate a standardized power grid dataset; Step S2: Extract feature vectors from the standardized power grid dataset using a preset multi-dimensional vector feature extraction strategy to generate a feature vector subset corresponding to each monitoring device; Step S3: Using a subset of feature vectors as samples, train a feature anomaly recognition model using an unsupervised learning algorithm. Use the feature anomaly recognition model to identify the corresponding abnormal data points in the monitoring equipment. Calculate the anomaly score of the abnormal data points using a preset isolated forest algorithm. Mark data points with anomaly scores higher than a preset anomaly score threshold as suspected anomalies. Step S4: Input suspected anomalies into a graph neural network to construct an anomaly propagation model; Step S5: Monitor the power grid corresponding monitoring equipment through the anomaly propagation model.

[0007] Further: Step S1 also includes a preprocessing sub-strategy, the preprocessing sub-strategy including Step S11: Obtain multi-source heterogeneous real-time data streams. By parsing the protocols and data structures of different data sources, determine the format and type of the original data streams. Step S12: According to the predefined same time standard, perform time alignment on real-time data streams from different sources. If the timestamp of the original data stream is abnormal, obtain the prediction data at the corresponding time through the preset data completion sub-strategy. Step S13: Process the data stream using a preset standard format to obtain a standard format data stream; Step S14: Normalize the data of the corresponding standard format data stream by using a preset normalization standard; Step S15: Perform Z-score standardization on the normalized data to obtain standard scores with a mean of 0 and a standard deviation of 1, and filter the standard score data that conforms to a normal distribution. Step S16: Construct the corresponding power grid operation dataset based on the standard score data.

[0008] Furthermore: the data completion sub-strategy includes: Step S121: Obtain the data streams uploaded by each power grid monitoring device, which include real-time voltage, real-time current, real-time power, and real-time frequency; Step S122: Obtain the ambient temperature and humidity data reported by the environmental monitoring equipment, determine the environmental dataset of each node of the power grid by associating the data source with the attributes of the power grid nodes, and merge the power grid operation dataset to obtain a holographic dataset of the power grid status that includes environmental factors. Step S123: According to the load level, classify the holographic dataset of power grid status, establish datasets under different load levels, and determine the normal fluctuation range of voltage, current, power and frequency under different load levels; Step S124: Construct an event dynamic case model from historical power grid operation data. The event dynamic case model reflects the change constraints of each data point under the corresponding event scenario. Step S125: Obtain the event scenario corresponding to the target time period of the missing data, retrieve the corresponding change constraints from the event dynamic case model according to the event scenario, and calculate the corresponding missing data through the change constraints and known data.

[0009] Furthermore: the multidimensional vector feature extraction strategy includes Step S21: Obtain the base data type of the corresponding data, and retrieve the vector construction group from the pre-built vector type table according to the base data type. Each vector construction group includes several different vector feature items. Step S22: Calculate the feature vectors of the corresponding data under different vector feature terms; Step S23: Integrate the feature vectors through the integration and correction sub-strategy to generate a comprehensive feature vector; Step S24: Perform cluster analysis on the comprehensive feature vectors for each time period to obtain the corresponding clusters, and label the corresponding comprehensive feature vectors according to the cluster type to generate the feature vector subset.

[0010] Furthermore, the vector feature terms include statistical feature terms, time-series feature terms, and frequency domain feature terms. The statistical feature terms include mean, maximum value, minimum value, and variance. The time-series feature terms include rate of change and trend measure.

[0011] Furthermore, the feature anomaly identification model includes corresponding verification layers with different verification conditions. Each verification condition corresponds to different data verification precision and data acquisition frequency. The feature anomaly identification model captures verification type features in the corresponding historical monitoring dataset, matches the corresponding verification layer according to the verification type features, retrieves the corresponding data to be verified according to the verification layer, obtains the original data class of the data to be verified, calculates the abnormal sub-features in the data to be verified based on the original data class, calculates the abnormal deviation sub-value of the abnormal sub-features, and marks the abnormal position of the data to be verified with an abnormal deviation sub-value greater than a preset value as an abnormal data point.

[0012] Further: The spatial correlation and electrical correlation of the abnormal data points are calculated using the isolated forest algorithm, and the spatial correlation and electrical correlation are input into the pre-constructed abnormal correlation map to generate abnormal correlation strength. The abnormal sub-score is calculated based on the abnormal correlation strength, and the abnormal score at that location is calculated using the corresponding abnormal correlation weighting formula.

[0013] Furthermore: the graph neural network includes several anomaly points, each anomaly point is equipped with several anomaly point items, each anomaly point corresponds to a corresponding monitoring device, and the anomaly point items correspond to anomaly types. The anomaly point items are connected by graph network lines. When any two anomaly point items have the same event triggering characteristics, the corresponding graph network connection is modified according to the event triggering characteristics to construct the graph neural network. When any continuous network path in the graph neural network meets the preset triggering constraint conditions, the corresponding network path is used as the anomaly event propagation path to construct the anomaly propagation model. The anomaly propagation model includes several anomaly event propagation paths, and each anomaly event propagation path includes several anomaly point items and trigger-state point item association lines.

[0014] Furthermore, the anomaly propagation model also includes a propagation law mirroring strategy. The propagation law mirroring strategy calculates the similarity of the transmission paths of anomaly events. When the similarity of any anomaly event transmission path is greater than a preset convergence condition, a propagation law is generated based on the anomaly event transmission path, and an additive trigger value is generated based on the propagation law. When the features of the graph neural network conform to the propagation law, the corresponding network path is given an additive trigger value to satisfy the corresponding triggering constraint condition.

[0015] This invention also provides a linkage anomaly analysis system for medium and low voltage power grid anomaly triggering, configured with any of the above-mentioned linkage anomaly analysis methods for medium and low voltage power grid anomaly triggering, characterized in that: it includes a data acquisition module, a data standardization module, a feature extraction module, an anomaly identification module, an anomaly propagation modeling module, and an anomaly triggering and integration module; The data acquisition module is used to acquire real-time data streams from different monitoring devices; The data standardization module is used to process real-time data streams; The feature extraction module is used to extract the feature vectors corresponding to the data stream in the corresponding historical dataset; The anomaly identification module is used to identify suspected anomalies in the corresponding historical dataset. The anomaly propagation modeling module is used to construct an anomaly propagation model based on suspected anomalies. The anomaly triggering and integration module is used to generate anomaly results by supervising the real-time data stream obtained through the anomaly identification model.

[0016] The technical solution of the present invention can include the following beneficial effects: by storing the data stream and extracting features, more data points under different types are obtained. At the same time, the correlation between different devices and different types of data is constructed. By establishing the correlation between feature vectors, different anomaly standards under each type are quantified. Based on the correlation, the corresponding suspected anomalies are evaluated as secondary training samples to construct an anomaly propagation model. This avoids the interference of useless data on the construction of the anomaly propagation model. Meanwhile, the anomaly propagation model generated by constructing correlation between suspected anomalies will be adjusted and optimized according to changes in scenarios and usage, thereby improving system reliability and the timeliness and accuracy of anomaly detection. Attached Figure Description

[0017] Figure 1 This is a flowchart of the linkage anomaly analysis method for medium and low voltage power grid anomaly triggering according to the present invention.

[0018] Figure 2 This is a schematic diagram of the linkage anomaly analysis method and system for medium and low voltage power grid anomaly triggering according to the present invention.

[0019] Figure 3 This is another schematic diagram of the linkage anomaly analysis method and system for medium and low voltage power grid anomaly triggering according to the present invention.

[0020] Figure 4 This is a schematic diagram of the linkage anomaly analysis method and system for medium and low voltage power grid anomaly triggering according to the present invention. Detailed Implementation

[0021] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] A method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids. Step S1: Obtain monitoring information from the monitoring equipment and process the monitoring information according to a preset format coordination strategy to generate a standardized power grid dataset; Step S1 further includes a preprocessing sub-strategy, which includes... Step S11: Obtain multi-source heterogeneous real-time data streams. By parsing the protocols and data structures of different data sources, determine the format and type of the original data streams. Specifically, monitoring equipment at various stages of the power grid, such as smart meters, synchronous phasor measurement units, and sensors, uploads real-time data streams to the data center via communication methods like 4G / 5G and fiber optics. For example, a smart meter on a 10kV distribution line uploads data every 15 seconds, with the data packet containing data such as three-phase voltage, three-phase current, active power, reactive power, and frequency at that moment. Simultaneously, sensors deployed at weather stations upload environmental data, including temperature, humidity, and wind speed, every 5 minutes via a wireless network. Load data is collected through a monitoring and data acquisition system; for example, a substation with a total load of 1000kW on the 10kV side acquires data every minute via a data interface. After these data streams from different sources and at different frequencies converge in the data center, they first undergo data cleaning and preprocessing, including handling missing values ​​and removing outliers. Then, a streaming computing framework is used to process the data in real time. For example, to calculate voltage imbalance, the specific algorithm is as follows: calculate the average of the three-phase voltage RMS values, and then calculate the percentage deviation of each phase voltage from the average value: the deviation of phase A is (225-225) / 225 * 100% = 0%, and the absolute value of the maximum deviation is taken as the voltage imbalance. Simultaneously, correlation analysis can be performed using load data and environmental data. For example, the Pearson correlation coefficient can be used to calculate the correlation between temperature and load. Assuming the calculated Pearson correlation coefficient is 85, it indicates a strong positive correlation between temperature and load. This processed and analyzed data can be used for applications such as real-time monitoring of the power grid, fault diagnosis, and load forecasting.

[0023] Step S12: Based on a predefined time standard, perform time alignment on real-time data streams from different sources. If the timestamp of the original data stream is abnormal, obtain the predicted data for the corresponding time using a preset data completion sub-strategy. The data completion sub-strategy includes: Step S121: Obtain the data streams uploaded by each power grid monitoring device, which include real-time voltage, real-time current, real-time power, and real-time frequency; Step S122: Obtain the ambient temperature and humidity data reported by the environmental monitoring equipment, determine the environmental dataset of each node of the power grid by associating the data source with the attributes of the power grid nodes, and merge the power grid operation dataset to obtain a holographic dataset of the power grid status that includes environmental factors. Step S123: According to the load level, classify the holographic dataset of power grid status, establish datasets under different load levels, and determine the normal fluctuation range of voltage, current, power and frequency under different load levels; specifically, obtain the data streams uploaded by each monitoring device of the power grid, which include real-time voltage, real-time current, real-time power and real-time frequency, and align the data through data time stamps to obtain the power grid operation dataset under a unified time reference. The system acquires ambient temperature and humidity data reported by environmental monitoring equipment, associates the data sources with the attributes of power grid nodes, determines the environmental datasets of each power grid node, and merges the power grid operation datasets to obtain a holographic dataset of power grid status that includes environmental factors. Based on the load level, the holographic dataset of power grid status is classified to establish datasets under different load levels. Statistical analysis methods are used to determine the normal fluctuation range of voltage, current, power and frequency under different load levels. On the other hand, if the real-time voltage, real-time current, real-time power, or real-time frequency exceeds the normal fluctuation range, an abnormal alarm will be triggered, and the specific location of the abnormality will be located through the grid node attributes. Based on the abnormal alarm information, data within a certain period before and after the abnormality occurred are extracted from the power grid status holographic dataset to construct time series data, which is then input into a pre-established abnormal diagnosis model based on a long short-term memory network. The LSTM model is used to analyze the changing trends of time series data to obtain the results of anomaly type judgment; If the judgment result is that the power grid is overloaded, then a load transfer operation is performed; Based on the holographic dataset of the power grid state after the load transfer operation, a prediction model is constructed using the random forest algorithm or gradient boosting tree algorithm to obtain the prediction result of the power grid state at the next moment after the operation.

[0024] Step S124: Construct an event dynamic case model from historical power grid operation data. The event dynamic case model reflects the change constraints of each data point under the corresponding event scenario. Step S125: Obtain the event scenario corresponding to the target time period of the missing data, retrieve the corresponding change constraints from the event dynamic case model according to the event scenario, and calculate the corresponding missing data through the change constraints and known data.

[0025] Step S13: Process the data stream using a preset standard format to obtain a standard format data stream; Step S14: Normalize the data of the corresponding standard format data stream by using a preset normalization standard; Step S15: Perform Z-score standardization on the normalized data to obtain standard scores with a mean of 0 and a standard deviation of 1. Filter the standard score data that conforms to a normal distribution. Acquire multi-source heterogeneous real-time data streams. By analyzing the protocols and data structures of different data sources, determine the format and type of the original data streams. Perform time alignment processing on the real-time data streams from different sources according to a predefined unified time granularity. If the timestamps of the original data streams do not meet the requirements, obtain data under a unified time granularity through interpolation or resampling methods. For the aligned time data, use a unified data format for conversion, converting data of different formats to a preset unified format to obtain a data stream with a consistent format. Using the set normalization parameters, select the minimum-maximum normalization method to numerically scale the converted data streams to obtain normalized data with a numerical range within a preset interval. Based on the normalized data, calculate the mean and standard deviation of each data dimension over a period of time to obtain the statistics required for Z-score standardization. The calculated statistics are used to perform Z-score standardization on the normalized data, obtaining standard scores with a mean of 0 and a standard deviation of 1, confirming that the data conforms to a normal distribution. These standard scores, processed through the above steps, form a standardized power grid operation dataset, which is then used for training and applying subsequent power grid state analysis and prediction models. Specifically, it is assumed that the real-time power grid data stream comes from three different data sources: a monitoring and data acquisition system, a phasor measurement unit, and a meteorological data system. First, the time granularity and data format are unified, converting all data to a time granularity of seconds and standardizing it to CSV format. For example, monitoring and data acquisition system data does not require conversion; phasor measurement data is averaged every 1000 data points and merged into second-level data; meteorological data is acquired and augmented before being filled into every second to form second-level data. Assume the original voltage data values ​​of the monitoring and data acquisition system are 225kV, 228kV, and 219kV, the original PMU current data value is 1001A, and the original temperature data value is 21°C. After filling from minutes to seconds, the temperature remains at 21°C for 60 consecutive seconds. Then, normalization is performed, assuming the preset range is [0,1]. For the voltage data, the maximum value of 225kV and the minimum value of 219kV are found. Using the formula: (original value - minimum value) / (maximum value - minimum value), 225kV is normalized to (225-219) / (225-219) = 1, 228kV is normalized to (228-219) / (225-219) = 5625, and 219kV is normalized to 0. For current data, assuming the historical maximum value is 1200A and the minimum value is 800A, then 1001A is normalized to (1001-800) / (1200-800) = 5025.For temperature data, assuming a historical high of 40°C and a low of -10°C, the normalized value for 21°C is (21 - (-10)) / (40 - (-10)) = 702. Finally, the Z-score standardization method is used to calculate the mean and standard deviation of all normalized data. Assuming the mean of the normalized voltage data is 6 and the standard deviation is 2; the mean of the normalized current data is 5 and the standard deviation is 15; and the mean of the normalized temperature data is 7 and the standard deviation is 1, the formula is used: (Normalized value - Mean) / Standard deviation. The normalized voltage value 5625 is standardized as (5625 - 6) / 2 = -1875. The current value 5025 is standardized as (5025 - 5) / 15 = 0167. The temperature value 702 is standardized as (702 - 7) / 1 = 02. After these processes, all data from different sources and in different formats are transformed into a distribution with a mean of 0 and a standard deviation of 1, forming a standardized power grid operation dataset that can be used for further analysis. This standardized data can be used as input for machine learning models for power grid condition assessment, fault prediction, and other purposes.

[0026] Step S16: Construct the corresponding power grid operation dataset based on the standard score data.

[0027] Specifically, the following steps are taken: Standardization processing is performed on the real-time data streams from different sources and in different formats to unify the time granularity and data format. A normalization method is used to scale the real-time data streams to a preset range, and a Z-score standardization method is used to transform the real-time data streams into a distribution with a mean of 0 and a standard deviation of 1, forming a standardized power grid operation dataset, including: Acquire multi-source heterogeneous real-time data streams, and determine the format and type of the original data streams by parsing the protocols and data structures of different data sources; Based on a predefined uniform time granularity, real-time data streams from different sources are time-aligned. If the timestamps of the original data streams do not meet the requirements, data with a uniform time granularity is obtained through interpolation or resampling methods. For data with aligned times, a unified data format is used for conversion, transforming data of different formats into a preset unified format to obtain a data stream with consistent format; By setting the normalization parameters, the minimum-maximum normalization method is selected to perform numerical scaling on the converted data stream to obtain normalized data with a numerical range within the preset interval. Based on the normalized data, calculate the mean and standard deviation of each data dimension over a period of time to obtain the statistics required for Z-score standardization; The calculated statistics were used to perform Z-score standardization on the normalized data to obtain standard scores with a mean of 0 and a standard deviation of 1, thus confirming that the data conformed to a normal distribution. The standardized scores processed through the above steps form a standardized power grid operation dataset, which can be used for training and application of subsequent power grid state analysis and prediction models.

[0028] Step S2: Extract feature vectors from the standardized power grid dataset using a preset multi-dimensional vector feature extraction strategy to generate a feature vector subset corresponding to each monitoring device; The multidimensional vector feature extraction strategy includes Step S21: Obtain the base data type of the corresponding data, and retrieve the vector construction group from the pre-built vector type table according to the base data type. Each vector construction group includes several different vector feature items. Step S22: Calculate the feature vectors of the corresponding data under different vector feature terms; Step S23: Integrate the feature vectors through the integration and correction sub-strategy to generate a comprehensive feature vector; Step S24: Perform cluster analysis on the comprehensive feature vectors for each time period to obtain the corresponding clusters, and label the corresponding comprehensive feature vectors according to the cluster type to generate the feature vector subset.

[0029] Specifically, the following steps are taken: For the standardized power grid operation dataset, multiple feature vectors reflecting the power grid operation status are extracted. These feature vectors include statistical feature vectors, time-series feature vectors, and frequency domain feature vectors. The statistical feature vectors include mean, variance, maximum value, and minimum value. The time-series feature vectors include rate of change and trend measure. The frequency domain feature vectors include dominant frequency, spectral centroid, and spectral bandwidth. Obtain a standardized power grid operation dataset, preprocess the data from each measurement point in the dataset to eliminate outliers and noise, and obtain a preprocessed dataset. , Indicates the first The minimum value of each measurement point. Indicates the number of samples. Indicates the first The measurement point of the first measurement point Each sample value; , Indicates the first The statistical feature vector of each measurement point, including the mean. ,variance Maximum value and minimum value ; Calculate the statistical characteristics of each measurement point in the preprocessed dataset, including the mean, variance, maximum and minimum values, to obtain a statistical feature vector. Based on the preprocessed dataset, the rate of change of data at each measurement point is calculated. The rate of change data is obtained by dividing the difference between the data at two consecutive time points by the time interval. The trend of the rate of change data over time is analyzed, the trend metric is extracted, and the time series feature vector is obtained. The preprocessed dataset is subjected to a Fast Fourier Transform to convert the time-domain signal into a frequency-domain signal, thus obtaining the spectrum data. Analyze the spectrum data, find the frequency corresponding to the peak in the spectrum, determine the dominant frequency, and calculate the frequency. , Indicates the first The variance of each measurement point Indicates the number of samples. This represents the j-th sample value at the i-th measurement point. Indicates the first The mean of the measurement points; , This represents the maximum value at the i-th measurement point. Indicates the number of samples. Represents the i-th measurement point. Each sample value; The weighted average frequency of the spectrum is used to obtain the spectral centroid, the width of the concentrated energy region of the spectrum is calculated to obtain the spectral bandwidth, and the frequency domain eigenvector is obtained. The statistical feature vector, time-series feature vector, and frequency domain feature vector of each measurement point are integrated to form a comprehensive feature vector. If the dimension of the comprehensive feature vector is too high, principal component analysis is used to reduce the dimension of the comprehensive feature vector to obtain the dimension-reduced feature vector. Based on the dimensionality-reduced feature vectors, the K-means clustering algorithm is used for cluster analysis to classify different operating states into different categories, thereby obtaining the classification results of the power grid operating states.

[0030] Specifically, suppose we have a standardized power grid operation dataset containing voltage data in volts, with time intervals of 1 second for 100 seconds. To extract feature vectors, we first calculate statistical features: the voltage mean is 220V, obtained by averaging all voltage values; the voltage variance is 4V², obtained by averaging the squared difference between each voltage value and the mean; the maximum voltage is 225V, found by iterating through all voltage values; the minimum voltage is 215V, also found through iteration. Then, we extract time-series features: we calculate the voltage rate of change, which is the average of the absolute values ​​of voltage changes per second. For example, assuming the voltage changes per second are 1V, -2V, 1V, 0V, etc., the rate of change is the average of the absolute values ​​of all these changes, assumed to be 5V / s; the trend measure is obtained by calculating the slope of a linear regression of the voltage series, assuming the voltage data increases over time, fitting a linear equation. To obtain the slope A value of 1V / s indicates a slight upward trend in voltage. Finally, frequency domain features are extracted: a Fast Fourier Transform (FFT) is performed on the voltage data to obtain the spectrum. Assuming the FFT result shows a peak at 1Hz, the dominant frequency is 1Hz; the spectral centroid, the "center of gravity" of the spectrum, is calculated by summing the products of each frequency component and its amplitude, then dividing by the sum of all amplitudes, and is assumed to be 15Hz; the spectral bandwidth is obtained by calculating the frequency range in the spectrum where the amplitude is higher than half the maximum amplitude, and is assumed to be 2Hz. These features can be used for power grid fault diagnosis. For example, excessive variance and high rate of change may indicate grid instability, and a shift in the dominant frequency may indicate generator faults. These features together constitute a feature vector describing the power grid's operating state, which can be input into a machine learning model for further analysis and prediction. Because these features are interconnected—for example, voltage rate of change and variance may both reflect the degree of voltage fluctuation, and trend measurement and dominant frequency may both reflect the long-term stability of the power grid—these features form a tight logical chain.

[0031] Step S3: Using a subset of feature vectors as samples, a feature anomaly recognition model is trained using an unsupervised learning algorithm. This model identifies corresponding abnormal data points in the monitoring equipment and calculates anomaly scores for these data points using a preset isolated forest algorithm. Data points with anomaly scores exceeding a preset threshold are marked as suspected anomalies. The vector feature terms include statistical, temporal, and frequency domain features. Statistical features include mean, maximum, minimum, and variance. Temporal features include rate of change and trend measurement. The feature anomaly recognition model includes corresponding verification layers with different verification conditions. Each verification condition corresponds to different data verification precision and data acquisition frequency. The model captures verification type features from the corresponding historical monitoring dataset, matches the corresponding verification layer based on the verification type features, retrieves the corresponding data to be verified based on the verification layer, obtains the original data class of the data to be verified, calculates the abnormal sub-features in the data to be verified based on the original data class, calculates the abnormal deviation sub-value of the abnormal sub-features, and marks the abnormal locations of the data to be verified with an abnormal deviation sub-value greater than a preset value as abnormal data points.

[0032] The isolated forest algorithm is used to calculate the spatial and electrical correlations of the anomalous data points. These correlations are then input into a pre-constructed anomalous correlation graph to generate anomalous correlation strength. An anomalous sub-score is calculated based on this strength, and the anomalous score for each location is calculated using the corresponding anomalous correlation weighting formula. We have a set of feature vectors describing user transaction behavior, such as (100, 5, 2), (150, 3, 1), (2000, 1, 1), (120, 6, 3), and (180, 4, 2). These feature vectors represent... To identify potential anomalous transactions, we can use the isolated forest algorithm. First, an isolated forest model is constructed, for example, with 100 trees. Each tree randomly selects features for splitting, and a maximum tree depth is set, for example, 10. Then, the aforementioned feature vectors are used as input data to train the isolated forest model. After the model is built, the anomalous score for each data point can be calculated. For example, for data point (100, 5, 2), the model calculates the average path length based on its path length in each tree and assigns an anomaly score of 45 according to the formula; for data point (150, 3, 1), the anomaly score is 4; for data point (2000, 1, 1), due to its significantly higher transaction amount and lower transaction frequency and number of locations, it may be isolated on a shallower path, thus its anomaly score might be 85; for (120, 6, 3), the anomaly score is 48; and for (180, 4, 2), the anomaly score is 42. Next, we need to preset an anomaly score threshold, for example, 7. The anomaly score of each data point is compared with the threshold. If the anomaly score of data point (2000, 1, 1) is 85, exceeding the threshold of 7, it is marked as a suspected anomaly.

[0033] Specifically as follows: Multiple feature vectors are obtained, and data preprocessing is performed on the multiple feature vectors to obtain a standardized dataset composed of the preprocessed feature vectors. Based on the standardized dataset, an isolation forest model is constructed to obtain the initial isolation forest model. The initial anomaly score for each data point in the standardized dataset is calculated using the initial isolated forest model to obtain the initial anomaly score for each data point. Based on the preset anomaly scoring threshold, the initial anomaly score is compared. If the initial anomaly score is greater than the preset anomaly scoring threshold, the data point is determined to be a first-type suspected anomaly. Feature analysis is performed on the first type of suspected anomalies to extract the key features corresponding to the first type of suspected anomalies and obtain the key feature set. Based on the set of key features, similarity matching is performed in the standardized dataset to obtain a set of normal data points similar to the first type of suspected anomalies; Based on the set of normal data points and the set of suspected outliers of the first category, the isolated forest model is retrained to obtain an optimized isolated forest model. Using the optimized isolated forest model, the outlier scores of all outlier data points are recalculated. If the new outlier scores still exceed the preset outlier score threshold, they are determined as final outliers and marked as outliers.

[0034] For the suspected anomaly points, spatial correlation and electrical correlation are calculated. The spatial correlation is calculated based on the geographical distance of the monitoring points, and the electrical correlation is calculated based on the electrical connection relationships of the power grid topology, including: Obtain the geographical coordinates of the monitoring points, and use the spatial distance formula to calculate the distance between any two points. Spatial distance between ,in To obtain the spatial distance matrix for the coordinates of the monitoring points; Based on the power grid topology, construct the node admittance matrix. ,in Represents a node and Mutual admittance between nodes, if nodes and If directly connected, their mutual admittance is calculated based on the line parameters; If not directly connected, then To obtain the electrical connection relationships between power grid nodes; For each suspected anomaly Select a space distance less than a preset threshold. The spatial correlation of the monitoring point set Si is 0 if the set is empty. Otherwise, based on sets Internal points and outliers Spatial distance calculation spatial correlation ; For each suspected anomaly Select the set of nodes in the power grid topology that are electrically connected to it. The set is obtained by breadth-first search or depth-first search algorithm. If the set is empty, the electrical correlation is 0. Otherwise, based on sets Internal points and outliers Calculate electrical correlation of electrical connection relationships ; Integrating spatial correlation Electrical Relevance The comprehensive correlation is obtained by using weighted average or other fusion methods. ,in and These are the weighting coefficients; Based on the obtained comprehensive correlation Set threshold ,like Greater than If the anomaly i is strongly correlated with other monitoring points, then it is considered that the anomaly i is significantly affected by other points; if Less than If so, then an independence determination will be made; Based on the independence determination results, the Isolation Forest algorithm is used to detect anomalies with strong independence, while graph neural network-based or clustering-based algorithms are used to detect anomalies and determine the anomaly type and level.

[0035] For example, a substation detects a suspected anomaly at point A, exhibiting significant voltage fluctuations. To analyze this anomaly, spatial correlation is first calculated. Assume there are two other monitoring points, B and C, within the substation. Point A's coordinates are (113, 39), point B's coordinates are (11301, 3901), and point C's coordinates are (11299, 3899), in latitude and longitude. The inverse distance weighting method is used to calculate spatial correlation, where the weight is inversely proportional to the square of the distance. The spherical distance between two points can be calculated using the Haversine formula: Where r is the Earth's radius, φ is latitude, and λ is longitude. The calculated distance between A and B is approximately 141 km, and the distance between A and C is also approximately 141 km. Therefore, the spatial correlation weight between A and B... Spatial correlation weights between A and C Then, we analyze electrical correlation. Assume that in the power grid topology, point A is connected to bus M1, point B is also connected to bus M1, and point C is connected to bus M2. M1 and M2 are connected via transformer T1. We define electrical distance as follows: the electrical distance between two points on the same bus is 1, and the electrical distance between points on two bus connected by a transformer is 2. Therefore, the electrical distance between A and B is 1, and the electrical distance between A and C is 2. Using the reciprocal of the electrical distance as the electrical correlation weight, the electrical correlation weight between A and B is... Electrical correlation weights between A and C By comprehensively considering both spatial and electrical correlations, the reference value of voltage data from monitoring points B and C for analyzing anomalies at point A can be more fully assessed. For example, the weighted average of spatial and electrical correlations can be used to obtain the comprehensive correlation. For instance, if the spatial weight is 4 and the electrical weight is 6, then the comprehensive correlation between A and B is 4*518 + 6*1 = 2672, and the comprehensive correlation between A and C is 4*518 + 6*5 = 2372. Therefore, the data from point B has slightly higher reference value for analyzing anomalies at point A than that from point C.

[0036] The construction of the anomaly correlation graph, wherein the nodes of the anomaly correlation graph are power grid equipment or monitoring points, and the edges of the anomaly correlation graph represent the correlation strength between nodes, wherein the correlation strength is a fusion of the spatial correlation value and the electrical correlation value, including: Obtain power grid topology data and extract equipment point information representing generators, transformers, buses, and transmission lines from it; At the same time, the monitoring point information of the monitoring and data acquisition system is obtained, and the voltage level and current value data corresponding to each monitoring point are obtained; Based on the geographic map data, obtain the spatial distance information between the equipment points and the monitoring points; Based on the spatial distance information between the equipment point and the monitoring point, the spatial correlation value is calculated. The smaller the spatial distance, the larger the spatial correlation value. If the spatial distance is greater than the preset spatial distance threshold, the spatial correlation value is set to zero; Obtain protection state information and fault state information; If at least one of the two nodes is in a protected or faulty state, the probability of an electrical connection between the two nodes increases. The magnitude of the increase in electrical correlation value is determined based on the increase in probability. Based on the line number and substation information, determine whether two nodes are directly connected by a line or located in the same substation. If two nodes are directly connected or located in the same substation, the electrical correlation value increases. If they are not directly connected and are not in the same substation, the electrical distance between nodes is calculated based on the power flow. The smaller the electrical distance, the greater the electrical correlation value. By combining spatial correlation values ​​and electrical correlation values, the strength of the correlation between nodes can be obtained; If the spatial correlation or electrical correlation value between two nodes is zero, then the correlation strength is zero. If both the spatial correlation and electrical correlation values ​​between two nodes are not zero, then the correlation strength is the weighted sum of the spatial correlation and electrical correlation values. Construct an adjacency matrix based on the strength of the association relationships between all nodes; The element values ​​in the adjacency matrix represent the strength of the association between the corresponding nodes; If the association strength is less than the preset association strength threshold, the corresponding element value in the adjacency matrix will be set to zero. Generate a power grid anomaly correlation map based on the adjacency matrix; In the graph, nodes represent equipment points and monitoring points, and edges represent the relationships between nodes. If the corresponding element in the adjacency matrix is ​​zero, then there is no edge between the two nodes; If the corresponding element value in the adjacency matrix is ​​not zero, then there is an edge between the two nodes, and the weight of the edge is the degree of association.

[0037] To construct a power grid anomaly correlation map, we can first obtain the geographical coordinates of power grid equipment and monitoring points through a geographic information system (GIS). For example, transformer A has coordinates (114, 39), circuit breaker B has coordinates (1145, 395), and line C connects A and B. The spatial distance between nodes is then calculated using the Euclidean distance formula: Set a spatial distance threshold, such as 1. Node pairs with distances less than this threshold are considered spatially correlated. The spatial correlation value can be determined based on the inverse ratio of distance, for example... Simultaneously, electrical connections are extracted from the power grid topology database. For example, if transformer A is connected to circuit breaker B via line C, then A and B have a direct electrical connection. For directly electrically connected node pairs, the electrical correlation value is set to 1; for node pairs indirectly connected through multiple devices, the electrical correlation value can be obtained through power flow calculations. For example, assuming that the active power transfer between A and B is 100MW and the total load of A is 200MW, the electrical correlation value between A and B can be defined as 100 / 200 = 5. To ensure that spatial correlation and electrical correlation values ​​are on the same scale, electrical correlation can be normalized, for example, with a maximum value of 1 and a minimum value controlled by setting a threshold, with values ​​below the threshold set to zero. Finally, the spatial correlation and electrical correlation values ​​are merged using a weighted average method: Correlation Strength = 6 * 934 + 4 * 5 = 7604. The weighting coefficients 6 and 4 can be adjusted according to the actual application scenario, representing the relative importance of spatial correlation and electrical correlation. This constructs an anomaly correlation graph containing nodes such as transformer A, circuit breaker B, and line C, with edges exhibiting correlation strength. This correlation strength value can be used for subsequent applications such as anomaly propagation analysis and fault location.

[0038] Step S4: Introduce suspected anomalies into a graph neural network to construct an anomaly propagation model. The graph neural network includes several anomalies, each with several anomaly items. Each anomaly corresponds to a monitoring device, and each anomaly item corresponds to an anomaly type. Anomaly items are connected by graph network lines. When any two anomaly items have the same event triggering characteristics, the corresponding graph network connection is modified according to the event triggering characteristics to construct the graph neural network. When any continuous network path in the graph neural network meets the preset triggering constraint conditions, the corresponding network path is used as the anomaly event propagation path to construct the anomaly propagation model. The anomaly propagation model includes several anomaly event propagation paths, and each anomaly event propagation path includes several anomaly items and trigger-state point item association lines.

[0039] The method utilizes a graph neural network to model the propagation path and impact range of abnormal events. The nodes of the graph neural network are power grid equipment or monitoring points, and the edges represent the relationships between these equipment or monitoring points. These relationships integrate spatial and electrical connections. The node features of the graph neural network are multiple feature vectors. Through the message passing mechanism of the graph neural network, the propagation patterns of anomalies in the power grid are learned to obtain an anomaly propagation model, including: Collect multi-dimensional feature vectors of power grid equipment and monitoring points, fuse spatial geographic location information and electrical topology connection information of the equipment, construct a power grid correlation matrix, and obtain the initial node features and edges of the graph neural network; Based on the power grid correlation matrix, construct the adjacency matrix A of the graph neural network, where Aij indicates whether there is a connection between node i and node j. If there is a connection, the value of Aij is 1, otherwise it is 0. By inputting the adjacency matrix A and the node feature matrix X into the graph neural network, and using graph convolution operations, the feature vector of each node is updated to obtain a new node feature vector that incorporates the information of neighboring nodes. Based on the updated node feature vectors, the attention mechanism is used to calculate the attention weights between nodes. The attention weights reflect the differences in importance of different neighboring nodes to the current node, and the weighted node features are obtained. The weighted node features are obtained, and iterative calculations are performed using a multi-layer graph neural network. Each layer of the graph neural network performs message passing and node feature update operations to obtain a deeply fused node feature representation. Based on the deeply fused node feature representation, the output layer of the graph neural network is used to predict the propagation probability of abnormal events. If the propagation probability of a certain node exceeds a preset threshold, the node is determined to be affected by the abnormality. All nodes identified as being affected by anomalies are identified. Based on the connections between nodes, the propagation path and scope of the anomaly are determined, thus obtaining a propagation model for the power grid anomaly.

[0040] The anomaly propagation model also includes a propagation law mirroring strategy. The propagation law mirroring strategy calculates the similarity of the transmission paths of anomalies. When the similarity of any anomaly transmission path is greater than a preset convergence condition, a propagation law is generated based on the anomaly transmission path, and an additive trigger value is generated based on the propagation law. When the features of the graph neural network conform to the propagation law, the corresponding network path is given an additive trigger value to satisfy the corresponding trigger constraint condition.

[0041] Step S5: Monitor the power grid corresponding monitoring equipment through the anomaly propagation model.

[0042] Based on the anomaly propagation law output by the anomaly propagation model, anomaly triggering conditions are generated, and corresponding power grid equipment or monitoring points are monitored in real time. If the anomaly triggering conditions are met, a comprehensive anomaly event is generated, including: Real-time data streams from power grid equipment and monitoring points are acquired, and through data preprocessing, multi-dimensional power grid data containing time series and spatial location information is generated. Based on the pre-established anomaly propagation model, multidimensional power grid data is analyzed to obtain the anomaly propagation patterns between different devices and monitoring points, and key features are extracted. Based on the extracted key features and anomaly propagation patterns, an anomaly triggering condition rule base is constructed, with each rule containing multiple judgment conditions and corresponding event levels; By using real-time data streams, the triggering conditions in the rule base are continuously matched. If the monitored power grid data meets all the judgment conditions of a certain rule, the corresponding abnormal event is triggered. For multiple single-point abnormal events that are triggered, determine whether there is a correlation based on the abnormality propagation pattern and spatial location relationship, and then perform event fusion; The decision tree algorithm is used to comprehensively analyze the type, level and spatiotemporal correlation of multiple single-point anomalous events to determine whether they need to be merged into a comprehensive anomalous event. If the decision tree algorithm determines that fusion is necessary, a comprehensive abnormal event record containing information on multiple single-point abnormal events is generated. This record includes power grid data and attribute information for all associated single-point abnormal events. The power grid fault knowledge base stores fault modes and their feature vectors. The comprehensive abnormal event is defined as "voltage fluctuation in a certain area, increased current in some lines, relay protection devices issuing tripping signals, and the monitoring and data acquisition system recording multiple switch trips." First, features are extracted from the comprehensive abnormal event; for example, voltage fluctuation amplitude is 15%, current increase amplitude is 20%, and the number of tripped switches is 3. These features are then quantified into vectors. Then, the cosine similarity algorithm is used to calculate the similarity between the abnormal event feature vector X and all fault modes in the knowledge base. For example, if there is a fault mode "line overload" in the knowledge base, its feature vector... Then calculate the cosine similarity between X and Y: Assuming a preset fault mode similarity threshold of 9, since 98 is greater than 9, the abnormal event is determined to be highly similar to the "line overload" fault mode. To ensure the integrity of the thought process and to link it to business operations, alarm information push is added. The diagnostic results are associated with relevant responsible personnel information. If all calculated similarities are below the threshold of 9, it is considered that there is no matching fault mode in the knowledge base. In this case, the system marks the abnormal event as a "novel fault" and stores its feature vector X in the knowledge base as a reference for future fault diagnosis. At the same time, the system triggers the expert system to intervene in the analysis and sends the analysis request and the event feature vector X to the expert system interface.

[0043] Furthermore, response strategies can be optimized based on anomaly diagnosis results: A power grid fault knowledge base is constructed to store known fault modes and their characteristics, causes, and handling solutions; a historical fault case library is constructed to store historical fault event records, which include anomaly characteristics, power grid topology, occurrence time, and handling solutions, including: The system retrieves power grid topology data and corresponding anomaly feature data from the historical fault case database. By performing graph-structured processing on the power grid topology data, it obtains the graph-structured power grid topology association information. Assuming the historical fault case database has been preprocessed using a fault mode recognition algorithm, if the system determines that the similarity between the current abnormal event and existing cases in the database is below a threshold of 70%, a similar case retrieval is initiated. First, the system extracts the feature vector of the current abnormal event, for example: abnormal voltage fluctuation amplitude of 15%, frequency deviation of 2Hz, involving 110kV line L1 of substation A, power grid topology showing a ring network supply, and occurrence time of 23:30 on May 16, 2024. Then, the distance between this feature vector and the feature vector of each case in the historical case library is calculated using the cosine similarity algorithm. For example, the cosine similarity with case B is calculated to be 65, and the cosine similarity with case C is 68. Case B records the voltage fluctuation of 12% and the frequency deviation of 15Hz on the 220kV line L2 of substation B. The power grid topology is radial power supply, and the time of occurrence is 18:00 on December 1, 2023. Case C records the voltage fluctuation of 18% and the frequency deviation of 25Hz on the 110kV line L3 of substation A. The power grid topology is ring network power supply, and the time of occurrence is 22:10 on January 10, 2024. Next, further evaluation was conducted, weighting the similarity scores. The weight for anomaly feature similarity was 5, for power grid topology similarity was 3, and for occurrence time similarity was 2. For Case B, the overall similarity score was 65*5+2*3+1*2=405, and for Case C, it was 68*5+1*3+8*2=8. Case C was selected due to its higher overall similarity. The proposed solution for Case C was: "Adjust the active power output of the generator set, increase the reactive power compensation capacity, and check the line protection devices." Based on the current anomaly event data, the system adjusted the solution to: "Increase the active power output of generator set G1 by 50MW, put reactive power compensation device M1 into operation, increase the reactive power compensation capacity by 10MVar, and check the line protection devices of the 110kV line L1 of substation A," generating the final emergency response suggestion. To establish a thought process, after generating the emergency response suggestion, it was immediately distributed to the relevant execution systems, and the execution results were tracked and fed back to the historical fault case database to update the case information, forming a closed-loop management system.

[0044] After obtaining the graph-structured power grid topology association information and case anomaly feature data, feature fusion processing is performed to obtain a fused feature vector, which contains power grid topology information and anomaly feature information. The fused feature vector is obtained, and an unsupervised clustering algorithm is used to perform cluster analysis on the fused feature vector to obtain multiple clusters, where each cluster represents a potential fault mode. Multiple clusters are obtained. For each cluster, its corresponding fault characteristics, fault causes, and historical solutions are extracted to construct fault mode knowledge entries and obtain a set of fault mode knowledge entries. A set of fault mode knowledge entries is obtained, and a structured storage is performed using database technology to construct a power grid fault knowledge base. The power grid fault knowledge base contains known fault modes and their characteristics, causes, and handling solutions. The system acquires real-time power grid operation data, extracts abnormal feature data from the real-time power grid operation data, and performs fault mode matching from the power grid fault knowledge base if the abnormal feature data meets the preset fault judgment threshold. Fault mode matching is performed from the power grid fault knowledge base. If a similar fault mode is matched, the corresponding handling plan is extracted. The fault is handled according to the extracted handling plan. For the comprehensive abnormal event, the type and cause of the abnormal event are inferred by combining the power grid fault knowledge base, and the fault mode similarity is calculated. If the similarity of any fault mode exceeds a preset fault mode similarity threshold, the fault diagnosis result is output, including: Detailed data information on comprehensive abnormal events is obtained, and historical fault data is retrieved from the power grid fault knowledge base to form a set of fault feature vectors; For the feature vectors of comprehensive abnormal events, feature extraction and dimensionality reduction are performed to obtain a simplified set of feature vectors; Based on the simplified set of feature vectors, the similarity between the vectors is calculated by matching them with the set of known fault mode feature vectors in the power grid fault knowledge base. If at least one fault mode has a similarity exceeding the preset fault mode similarity threshold, the fault mode with the highest similarity will be output as the preliminary diagnostic result. Based on the preliminary diagnostic results, and combined with the power grid operation status data at the time of the comprehensive abnormal event, information fusion is performed to obtain the fused comprehensive information; Based on the integrated information, the reliability of the preliminary diagnosis results is evaluated using the decision tree algorithm, and the reliability evaluation result is obtained. If the credibility assessment result is higher than the preset credibility threshold, the preliminary diagnosis result will be output as the final fault diagnosis result. If the credibility assessment result is lower than the preset credibility threshold, the process reverts to step three, using a support vector machine or random forest algorithm to recalculate the similarity. If no highly similar fault mode exists, similar cases are retrieved from the historical fault case database. The similarity in anomaly characteristics, power grid topology, and occurrence time is assessed. Based on the handling plans for similar cases and combined with current anomaly event data, emergency response suggestions are generated, including: Obtain the set of failure modes for all cases in the historical failure case library, calculate the similarity between the failure mode of the current abnormal event and the historical failure modes, determine whether there are high similarity failure modes, and if there are no high similarity failure modes, proceed to the next step. The system retrieves a set of cases with similarity higher than a preset threshold from the historical fault case database. For these similar cases, it extracts the abnormal feature vector, power grid topology diagram, and fault occurrence timestamp. Obtain the current abnormal event's abnormal feature vector, the current power grid topology diagram, and the current timestamp, and calculate the similarity between the current abnormal event and each historical similar case in terms of abnormal features, power grid topology, and occurrence time. Based on the similarity of abnormal features, power grid topology, and occurrence time, the overall similarity between the current abnormal event and each historical similar case is comprehensively evaluated. Obtain a set of handling solutions corresponding to the most similar historical cases with the highest overall similarity from the historical failure case database; The system acquires real-time monitoring data streams of current abnormal events, uses a pre-trained abnormal event classification model, and determines the subcategory to which the current abnormal event belongs based on the real-time monitoring data streams. Based on the subcategory of the current abnormal event and the set of historical similar cases with the highest overall similarity, combined with the current real-time monitoring data stream, a sequence of emergency response suggestions for the current abnormal event is generated using a rule engine or recurrent neural network algorithms such as LSTM and GRU.

[0045] The construction of a power grid fault knowledge base and a historical fault case database can be integrated as follows: First, the fault mode knowledge base can be stored using RDF triples, for example: Line L1 overload, characteristics: current exceeds 120% of rated value; Line L1 overload, cause: downstream transformer B1 fault; Line L1 overload, handling plan: transfer load to line L2. Here, "Line L1 overload" is the subject, "characteristics," "cause," and "handling plan" are the predicates, and specific descriptions such as "current exceeds 120% of rated value" are the objects. Feature extraction can utilize wavelet transform to analyze current waveforms and set thresholds; for example, a total harmonic distortion rate exceeding 5% is considered a harmonic exceedance feature. Cause analysis can be combined with a Bayesian network. Multiple features are input, and probabilistic inference is used to calculate the posterior probability of each fault cause. For example, if the current exceeds 120% and the temperature sensor shows 80℃, the Bayesian network calculates the probability of transformer B1 fault as 85% and the probability of line L1 overload as 1%. The handling plan is based on preset rules, such as the IF-THEN rule: IF line L1 is overloaded AND line L2 load rate is below 70% THEN transfer the load to line L2. The historical fault case database is stored in a relational database. Each record contains fields: fault ID, anomaly characteristics, power grid topology (using Neo4j graph database to store the relationships between nodes and edges, e.g., line L1 connects substation A and substation B), occurrence time (timestamp format, e.g., 2024-07-24 10:30:00), and handling plan (text description, e.g., "load transfer has been performed"). When a new fault occurs, its anomaly characteristics are extracted, and the K-nearest neighbor algorithm is used to search for similar cases in the historical case database. For example, the Euclidean distance between the feature vector of the new fault and the feature vectors of historical cases is calculated, and the K closest cases are selected, with their handling plans referenced. Simultaneously, new fault cases and their handling results are also updated in the historical case database, enabling the knowledge base to learn and improve itself. This method connects the two databases, forming an organic whole.

[0046] A linkage anomaly analysis system for medium and low voltage power grid anomalies, configured with any of the above-mentioned linkage anomaly analysis methods for medium and low voltage power grid anomalies, including a data acquisition module, a data standardization module, a feature extraction module, an anomaly identification module, an anomaly propagation modeling module, and an anomaly triggering and integration module; The data acquisition module is used to acquire real-time data streams from different monitoring devices; it is also used to acquire real-time data streams generated by monitoring devices at various stages of the power grid, including voltage, current, power, and frequency data, as well as environmental and load data. The data standardization module is used to process real-time data streams; it is used to standardize real-time data streams from different sources and in different formats, unify the time granularity and data format, scale the real-time data streams to a preset range using a normalization method, and transform the real-time data streams into a distribution with a mean of 0 and a standard deviation of 1 using a Z-score standardization method, thereby forming a standardized power grid operation dataset. The feature extraction module is used to extract feature vectors corresponding to the data streams in the corresponding historical dataset; it is used to extract multiple feature vectors reflecting the power grid operation status for the standardized power grid operation dataset. The multiple feature vectors include statistical feature vectors, time-series feature vectors, and frequency domain feature vectors. The statistical feature vectors include mean, variance, maximum value, and minimum value. The time-series feature vectors include rate of change and trend measurement. The frequency domain feature vectors include dominant frequency, spectral centroid, and spectral bandwidth. The anomaly identification module is used to identify suspected anomalies in the corresponding historical dataset; the anomaly identification module includes an unsupervised anomaly detection module, a correlation calculation module, and an anomaly association graph construction module.

[0047] The anomaly propagation modeling module is used to construct an anomaly propagation model based on suspected anomalies; to identify potential anomalous data points using an unsupervised anomaly detection algorithm for the multiple feature vectors, to calculate anomaly scores for each data point using the isolated forest algorithm, and to mark data points with anomaly scores exceeding a preset anomaly score threshold as suspected anomalies; to calculate spatial correlation and electrical correlation for the suspected anomalies, wherein the spatial correlation is calculated based on the geographical distance of the monitoring point, and the electrical correlation is calculated based on the electrical connection relationships of the power grid topology; and to construct an anomaly correlation graph, wherein the nodes of the anomaly correlation graph are power grid equipment or monitoring points, and the edges of the anomaly correlation graph are nodes. The strength of the correlation between nodes is determined by integrating the spatial correlation value and the electrical correlation value. This is used to model the propagation path and impact range of abnormal events using a graph neural network. The nodes of the graph neural network are power grid equipment or monitoring points, and the edges represent the correlation between these equipment or monitoring points. The correlation integrates spatial and electrical connection relationships. The node features of the graph neural network are multiple feature vectors. Through the message passing mechanism of the graph neural network, the propagation law of anomalies in the power grid is learned to obtain an anomaly propagation model. Assume the power grid contains 5 nodes, representing transformer T1, bus B1, line L1, line L2, and load F1. The node feature vectors include voltage amplitude, phase angle, active power, and reactive power. The initial node features are as follows: T1 (05, 0, 10, 2), B1 (02, -1, 8, 5), L1 (0, -2, 6, 1), L2 (98, -3, 4, 5), F1 (95, -4, -10, -2). The relationships between nodes are represented by an adjacency matrix A, where This indicates that nodes i and j are directly connected; otherwise, it is 0. Considering spatial and electrical connections, A = [[0, 1, 0, 0, 0], [1, 0, 1, 1, 0], [0, 1, 0, 0, 1], [0, 1, 0, 0, 1], [0, 0, 1, 1, 0]]. Using a Graph Convolutional Network (GCN) as the graph neural network model, its message passing mechanism can be represented as: ,in Represents a node In the The feature vector of the layer, Represents a node The set of neighboring nodes, Represents a node The degree, i.e., the number of edges connected. and It is the first Layer weight matrix and bias vector, This is the activation function; ReLU is chosen here. Assume there is only one layer of GCN, with the weight matrix W as [[1, 2, 3, 4], [2,3, 4, 1], [3, 4, 1, 2], [4, 1, 2, 3]], and the bias vector b as [1, 0, -1, 2]. Initially, assuming a fault occurs on line L2, its active and reactive power abruptly drop to 0, the voltage amplitude drops to 8, and the phase angle becomes -10, meaning L2 becomes (8, -10, 0, 0). This fault information is used as input, and a message is passed through the GCN to update the features of each node. For example, for node B1, its neighbors are T1, L1, and L2, with a degree of 3. First, the normalization coefficients are calculated: T1 has a degree of 1, L1 has a degree of 2, and L2 has a degree of 2, so the corresponding normalization coefficients are... Then perform a weighted summation: Substituting specific numerical values, a 4-dimensional vector is obtained. This vector is then added to a bias vector b, and finally, the ReLU activation function is applied to obtain the updated feature vector of node B1. The features of other nodes are updated similarly. This process is iterated multiple times to simulate the propagation of an anomaly in the power grid. The final converged node feature vector reflects the scope of the anomaly's impact. By analyzing the changes in the feature vectors of each node, the propagation path and scope of the anomaly can be assessed.

[0048] The anomaly triggering and integration module is used to generate anomaly results by monitoring the real-time data stream acquired through the anomaly identification model. For example, the anomaly propagation law output by the power grid anomaly propagation model is as follows: when the voltage fluctuation at monitoring point A exceeds 10% and lasts for more than 5 seconds, and the current at the adjacent monitoring point B increases by more than 15%, the anomaly is considered to have propagated from A to B. Based on this law, we can construct anomaly triggering conditions. The specific implementation method is as follows: real-time acquisition of voltage data at monitoring point A, and calculation of the voltage fluctuation percentage every 5 seconds using a sliding window algorithm. Assuming that at a certain moment, the voltage values ​​for 5 consecutive seconds are: 245V, 248V, 242V, 250V, 247V, then the maximum fluctuation percentage is (250-220) / 220 * 100% = 164%, exceeding 10%. Simultaneously, the program continuously monitors the duration of voltage fluctuations exceeding 10%. If the duration counter reaches 5 seconds, the first triggering condition is met. At the same time, the system acquires current data at monitoring point B in parallel, and the sliding window algorithm is also used to calculate the current increase percentage every 5 seconds. Assuming that within 5 seconds of the voltage fluctuation exceeding the limit, the current values ​​at monitoring point B are: 116A, 118A, 117A, 119A, 120A, with a maximum increase percentage of (120-100) / 100 * 100% = 20%, exceeding 15%, the second trigger condition is met. When both trigger conditions are met, the system immediately generates a comprehensive abnormal event, recording the event occurrence time, involved monitoring points, abnormal type, and relevant values. This record is stored in the database and triggers an alarm to notify relevant maintenance personnel. Since the generation of the abnormal event is entirely based on real-time data streams and preset rules, the entire process requires no manual intervention and can be completed automatically by the program. To form a chain of information, the comprehensive abnormal event can be associated with the equipment ledger. For example, if monitoring points A and B correspond to the low-voltage side of transformer T1 and feeder F1 respectively, then the comprehensive abnormal event will be directly associated with transformer T1 and feeder F1, facilitating subsequent fault location and equipment maintenance.

[0049] It may also include an anomaly triggering and integration module, which is used to generate anomaly triggering conditions based on the anomaly propagation law output by the anomaly propagation model, monitor the corresponding power grid equipment or monitoring point in real time, and generate a comprehensive anomaly event if the anomaly triggering conditions are met. The fault knowledge base and case library construction module is used to build a power grid fault knowledge base, store known fault modes and their characteristics, causes, and handling solutions, and build a historical fault case library, which stores historical fault event records, including abnormal characteristics, power grid topology, occurrence time, and handling solutions. The fault diagnosis module is used to infer the type and cause of the abnormal event based on the comprehensive abnormal event and the power grid fault knowledge base, calculate the fault mode similarity, and output the fault diagnosis result if the similarity of the fault modes exceeds the preset fault mode similarity threshold. The emergency response suggestion generation module is used to retrieve similar cases from the historical fault case database if no highly similar fault modes exist, assess the similarity of abnormal characteristics, power grid topology, and occurrence time, and generate emergency response suggestions based on the handling plans of similar cases and the current abnormal event data.

[0050] It will be apparent to those skilled in the art that this application is not limited to the details of the exemplary embodiments described above, and that this application can be implemented in other specific forms without departing from the spirit or essential characteristics of this application. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within this application. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids, characterized in that, Step S1: Obtain monitoring information from the monitoring equipment and process the monitoring information according to a preset format coordination strategy to generate a standardized power grid dataset; Step S2: Extract feature vectors from the standardized power grid dataset using a preset multi-dimensional vector feature extraction strategy to generate a feature vector subset corresponding to each monitoring device; Step S3: Using a subset of feature vectors as samples, train a feature anomaly recognition model using an unsupervised learning algorithm. Use the feature anomaly recognition model to identify the corresponding abnormal data points in the monitoring equipment. Calculate the anomaly score of the abnormal data points using a preset isolated forest algorithm. Mark data points with anomaly scores higher than a preset anomaly score threshold as suspected anomalies. Step S4: Input suspected anomalies into a graph neural network to construct an anomaly propagation model; Step S5: Monitor the power grid's corresponding monitoring equipment using the anomaly propagation model; The multidimensional vector feature extraction strategy includes Step S21: Obtain the base data type of the corresponding data, and retrieve the vector construction group from the pre-built vector type table according to the base data type. Each vector construction group includes several different vector feature items. Step S22: Calculate the feature vectors of the corresponding data under different vector feature terms; Step S23: Integrate the feature vectors through the integration and correction sub-strategy to generate a comprehensive feature vector; Step S24: Perform cluster analysis on the comprehensive feature vectors for each time period to obtain the corresponding clusters, and label the corresponding comprehensive feature vectors according to the cluster type to generate the feature vector subset; The graph neural network includes several anomaly points, each with several anomaly point items. Each anomaly point corresponds to a corresponding monitoring device, and each anomaly point item corresponds to an anomaly type. The anomaly point items are connected by graph network lines. When any two anomaly point items have the same event triggering characteristics, the corresponding graph network connection is modified according to the event triggering characteristics to construct the graph neural network. When any continuous network path in the graph neural network meets the preset triggering constraint conditions, the corresponding network path is used as the anomaly event propagation path to construct the anomaly propagation model. The anomaly propagation model includes several anomaly event propagation paths, and each anomaly event propagation path includes several anomaly point items and trigger-state point item association lines.

2. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 1, characterized in that: Step S1 further includes a preprocessing sub-strategy, which includes... Step S11: Obtain multi-source heterogeneous real-time data streams. By parsing the protocols and data structures of different data sources, determine the format and type of the original data streams. Step S12: According to the predefined same time standard, perform time alignment on real-time data streams from different sources. If the timestamp of the original data stream is abnormal, obtain the prediction data at the corresponding time through the preset data completion sub-strategy. Step S13: Process the data stream using a preset standard format to obtain a standard format data stream; Step S14: Normalize the data of the corresponding standard format data stream by using a preset normalization standard; Step S15: Perform Z-score standardization on the normalized data to obtain standard scores with a mean of 0 and a standard deviation of 1, and filter the standard score data that conforms to a normal distribution. Step S16: Construct the corresponding power grid operation dataset based on the standard score data.

3. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 2, characterized in that: The data completion sub-strategies include: Step S121: Obtain the data streams uploaded by each power grid monitoring device, which include real-time voltage, real-time current, real-time power, and real-time frequency; Step S122: Obtain the ambient temperature and humidity data reported by the environmental monitoring equipment, determine the environmental dataset of each node of the power grid by associating the data source with the attributes of the power grid nodes, and merge the power grid operation dataset to obtain a holographic dataset of the power grid status that includes environmental factors. Step S123: According to the load level, classify the holographic dataset of power grid status, establish datasets under different load levels, and determine the normal fluctuation range of voltage, current, power and frequency under different load levels; Step S124: Construct an event dynamic case model from historical power grid operation data. The event dynamic case model reflects the change constraints of each data point under the corresponding event scenario. Step S125: Obtain the event scenario corresponding to the target time period of the missing data, retrieve the corresponding change constraints from the event dynamic case model according to the event scenario, and calculate the corresponding missing data through the change constraints and known data.

4. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 3, characterized in that: The vector feature terms include statistical feature terms, time-series feature terms, and frequency domain feature terms. The statistical feature terms include mean, maximum value, minimum value, and variance. The time-series feature terms include rate of change and trend measure.

5. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 1, characterized in that: The feature anomaly identification model includes corresponding verification layers with different verification conditions. Each verification condition has different data verification accuracy and data acquisition frequency. The feature anomaly identification model captures verification type features in the corresponding historical monitoring dataset, matches the corresponding verification layer according to the verification type features, retrieves the corresponding data to be verified according to the verification layer, obtains the original data class of the data to be verified, calculates the abnormal sub-features in the data to be verified based on the original data class, calculates the abnormal deviation sub-value of the abnormal sub-features, and marks the abnormal position of the data to be verified with an abnormal deviation sub-value greater than a preset value as an abnormal data point.

6. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 5, characterized in that: The spatial and electrical correlations of the anomalous data points are calculated using the isolated forest algorithm. These correlations are then input into a pre-constructed anomalous correlation map to generate anomaly correlation strength. Anomaly sub-scores are calculated based on the anomalous correlation strengths, and the anomalous score at that location is calculated using the corresponding anomalous correlation weighting formula.

7. The method for analyzing linkage anomalies triggered by abnormalities in medium and low voltage power grids as described in claim 6, characterized in that: The anomaly propagation model also includes a propagation law mirroring strategy. The propagation law mirroring strategy calculates the similarity of the transmission paths of anomalies. When the similarity of any anomaly transmission path is greater than a preset convergence condition, a propagation law is generated based on the anomaly transmission path, and an additive trigger value is generated based on the propagation law. When the features of the graph neural network conform to the propagation law, the corresponding network path is given an additive trigger value to satisfy the corresponding trigger constraint condition.

8. A linkage anomaly analysis system for medium- and low-voltage power grid anomalies, configured with a linkage anomaly analysis method for medium- and low-voltage power grid anomalies as described in any one of claims 1-7, characterized in that: It includes a data acquisition module, a data standardization module, a feature extraction module, an anomaly identification module, an anomaly propagation modeling module, and an anomaly triggering and synthesis module; The data acquisition module is used to acquire real-time data streams from different monitoring devices; The data standardization module is used to process real-time data streams; The feature extraction module is used to extract the feature vectors corresponding to the data stream in the corresponding historical dataset; The anomaly identification module is used to identify suspected anomalies in the corresponding historical dataset. The anomaly propagation modeling module is used to construct an anomaly propagation model based on suspected anomalies. The anomaly triggering and integration module is used to generate anomaly results by supervising the real-time data stream obtained through the anomaly identification model. The multidimensional vector feature extraction strategy includes Step S21: Obtain the base data type of the corresponding data, and retrieve the vector construction group from the pre-built vector type table according to the base data type. Each vector construction group includes several different vector feature items. Step S22: Calculate the feature vectors of the corresponding data under different vector feature terms; Step S23: Integrate the feature vectors through the integration and correction sub-strategy to generate a comprehensive feature vector; Step S24: Perform cluster analysis on the comprehensive feature vectors for each time period to obtain the corresponding clusters, and label the corresponding comprehensive feature vectors according to the cluster type to generate the feature vector subset.

Images