A method and system for identifying and tracing power data anomalies

Abstract

The application discloses a kind of power data anomaly identification and tracing method and system, method includes: obtaining power equipment operation data and topological information and constructs graph structure;Calculate the attention coefficient between each node in graph structure and its neighbor node, calculate the spatial feature of each node according to the attention coefficient and feature vector of neighbor node;Obtain the spatial feature history sequence of each node and carry out time mode learning to obtain index prediction value, calculate abnormal score according to index prediction value and index observation value;When abnormal score is greater than dynamic threshold, corresponding node is abnormal node of operation data anomaly, according to the attention coefficient between abnormal node and its neighbor node, filter upstream neighbor node as suspect object node, carry out double counterfactual reasoning from suspect object node, obtain abnormal tracing result corresponding to abnormal node.The application realizes the efficient automation of tracing process and the precision of diagnostic result, significantly improves power grid data management quality.

Description

TECHNICAL FIELD

[0001] The present application relates to power equipment data analysis technology, and in particular to a power data anomaly identification and tracing method and system. BACKGROUND

[0002] With the rapid development of smart grid, the power consumption information collection system has covered a large number of power users, and can automatically collect the operation data of users such as power consumption indication value, voltage, current, etc., forming valuable power big data resources. These data are not only the basis for electricity settlement, but also provide important support for advanced applications such as load forecasting, power grid planning, and equipment state evaluation. Therefore, it is crucial to ensure the accuracy and integrity of these data.

[0003] However, in actual operation, due to various complex factors such as collection equipment failure, unstable communication network, data transmission packet loss, main station system parsing error or user profile information error, various anomalies will inevitably exist in the collected power data, such as data missing, constant numerical value, sudden spikes or serious deviation from normal power consumption mode, etc.

[0004] Currently, the following technical defects exist in the processing of these data anomalies:

[0005] Firstly, in terms of anomaly identification, the existing methods mostly rely on pre-set fixed thresholds or simple logical rules, such as judging whether the voltage exceeds ±7% limit value or whether the power consumption is zero. The limitations of this method are very obvious: (1) The rules are fixed and cannot adapt to the different power consumption habits of residents, businesses, industries and other types of users, resulting in high false and missed report rates; (2) Low sensitivity, difficult to identify cases where the numerical value changes little but the power consumption mode has changed.

[0006] Secondly, in terms of anomaly tracing, once an anomaly is found, it usually relies on manual investigation by operation and maintenance personnel. Data from the electric energy meter to the final application needs to go through local communication, collection terminal, remote communication, collection main station, data warehousing and other links, and the investigation process is like finding a needle in a haystack. This manual tracing method: (1) Low efficiency, requiring cross-system query of logs and status, consuming a lot of manpower and time; (2) Poor accuracy, the tracing result is heavily dependent on the personal experience of operation and maintenance personnel, and for complex, multi-link coupled anomalies, it is difficult to accurately locate the root cause. In addition, in the aspect of tracing analysis, the existing methods can only locate the suspicious device node, and for link problems caused by communication interruption, data packet loss, etc., there is a lack of effective and quantifiable diagnostic means, making it difficult to distinguish between device failure and transmission link failure. SUMMARY

[0007] The technical problems solved by the present application are: In view of the above problems of the prior art, a power data anomaly identification and tracing method and system are provided, which can realize automatic and accurate identification of massive and heterogeneous power data, and quickly and accurately trace and locate the root cause of the anomaly after the anomaly is found, thereby fundamentally improving the efficiency and quality of power grid data management.

[0008] To solve the above technical problems, the technical scheme adopted by the present application is:

[0009] A power data anomaly identification and tracing method comprises the following steps:

[0010] S1: Obtain the operation data and topology information of the power equipment and construct a graph structure, the nodes in the graph structure correspond one-to-one to the power equipment, and each node has a feature vector of the corresponding power equipment, the feature vector includes time series data of the index of the power equipment, and if two power equipment are directly connected, there is an edge between the corresponding nodes in the graph structure and they are adjacent nodes;

[0011] S2: input the graph structure into a trained graph time series model, the graph time series model calculates the attention coefficient between each node and its neighbor nodes in the graph structure, weights and sums the feature vectors of all neighbor nodes of the same node according to the attention coefficient, obtains the spatial feature of each node, further obtains the historical sequence of the spatial feature of each node and performs time pattern learning, obtains the corresponding index prediction value, and calculates the corresponding anomaly score according to the index prediction value and the index observation value of each node;

[0012] S3: if the anomaly score is greater than the dynamic threshold, the corresponding node is an abnormal node, and the operation data of the power equipment corresponding to the abnormal node is abnormal, the upstream neighbor nodes are selected as the suspected object nodes in the order of the attention coefficient from large to small between the abnormal node and its neighbor nodes, and double counterfactual reasoning is performed from the suspected object nodes to obtain the abnormal tracing result corresponding to the abnormal node.

[0013] Further, the mathematical expression of the attention coefficient between each node and its neighbor nodes in the graph structure is as follows:

[0014]

[0015] wherein, represents the attention coefficient between the i-th node and its neighbor node j in the graph structure, represents the attention score, normalized by the softmax function, represents the corrected attention score between the i-th node and its neighbor node j, and the mathematical expression is as follows:

[0016]

[0017] where, is the original attention score between the i-th node and its neighbor node j, is calculated according to the electrical distance between node i and j a bias term calculated as:

[0018]

[0019]

[0020] where LeakyReLU is a ReLU activation function with leakage, is a learnable attention vector transpose of is a learnable weight matrix, and are the feature vectors of node i and j, respectively, is a learnable scale parameter.

[0021] Further, the mathematical expression of the spatial feature of each node is as follows:

[0022]

[0023] where, denotes the attention coefficient between the i-th node and its neighbor node j in the graph structure, is a learnable weight matrix, is the feature vector of node j, is the total number of neighbor nodes of the i-th node in the graph structure.

[0024] Further, when obtaining the historical sequence of the spatial feature of each node and performing time pattern learning, the following steps are included:

[0025] Replace the sinusoidal position encoding in the standard Transformer with multi-dimensional periodic position encoding, and the mathematical expression of the multi-dimensional periodic position encoding is as follows:

[0026]

[0027] where and are learnable embedding layers for hours of the day and days of the week respectively;

[0028] For each time step , calculate the input sequence of the Transformer encoder, and the mathematical expression is as follows:

[0029]

[0030] wherein, are input features for each time step, and the mathematical expression is as follows:

[0031]

[0032] wherein, is a spatial side feature, representing the spatial feature of the i-th node in the graph structure at time step , , , is a learnable parameter, is a nonlinear activation function, is a multi-dimensional periodic position encoding at time step ;

[0033] The input sequence is input to the Transformer encoder to obtain the encoding representation of each time step, and the mathematical expression is as follows:

[0034]

[0035] wherein, is the output of the attention sublayer, denoted as , and:

[0036]

[0037] wherein, are query, key and value matrices respectively, , is a learnable parameter matrix, is the feature dimension of the attention space, is a periodic bias matrix, and the value of the element is set based on the time interval between time steps i and j, when is a multiple of 24 hours or 7x24 hours, is assigned a positive value, otherwise a negative value is assigned, and the order of magnitude of the negative value is greater than that of the positive value;

[0038] Based on the encoding representation of each time step, a corresponding prediction value vector is obtained through a linear mapping layer, and each component in the prediction value vector is the prediction result of a different index, and the mathematical expression of the prediction value vector is as follows:

[0039]

[0040] wherein, and is a learnable parameter, represents a predicted value vector of the i-th node in the graph structure at time step t, represents an encoded representation of the i-th node in the graph structure at time step t.

[0041] Further, when calculating the corresponding anomaly score according to the index predicted value and the index observed value of each node, the mathematical expression is as follows:

[0042]

[0043] wherein, represents an anomaly score of the i-th node in the graph structure at time step t, represents an observed value of the index m of the i-th node in the graph structure at time step t, represents a predicted value of the index m of the i-th node in the graph structure at time step t, represents a weight coefficient corresponding to the index m, represents different indexes, wherein U is voltage, I is current, and P is active power.

[0044] Further, after calculating the corresponding anomaly score according to the index predicted value and the index observed value of each node, the method further comprises: calculating a dynamic threshold, and the mathematical expression is as follows:

[0045]

[0046] wherein, is a dynamic threshold, and are respectively a mean value and a standard deviation of the anomaly score in one period under normal working conditions, is an adjustable parameter.

[0047] Further, when performing double counterfactual reasoning from the suspect object node, the method specifically comprises:

[0048] obtaining running state data and communication state data from the feature vector of each suspect object node;

[0049] replacing the running state data of each suspect object node with a normal reference value, thereby updating the graph structure to a first counterfactual graph corresponding to each suspect object node, taking each first counterfactual graph as a new graph structure, and performing step S2 again to obtain a first counterfactual anomaly score of the abnormal node corresponding to each suspect object node, and calculating a node contribution degree corresponding to each suspect object node according to the original anomaly score and the first counterfactual anomaly score of the abnormal node.

[0050] replace the communication state data of each suspect object node with an ideal value respectively, thereby updating the graph structure to a second counterfactual graph corresponding to each suspect object node, taking each second counterfactual graph as a new graph structure, and performing step S2 again to obtain a second counterfactual anomaly score of the abnormal node corresponding to each suspect object node, and calculating a link contribution degree corresponding to each suspect object node according to the original anomaly score and the second counterfactual anomaly score of the abnormal node;

[0051] According to the node contribution degree and the link contribution degree corresponding to the same suspect object node, a total contribution degree is calculated, and the suspect object node with the highest total contribution degree is taken as a new abnormal node, and the step of filtering upstream neighbor nodes as suspect object nodes in descending order of the attention coefficient between the abnormal node and its neighbor nodes is performed again to trace upstream suspect object nodes until the iteration termination condition is met.

[0052] The node contribution degree and the link contribution degree of the suspect object node with the highest total contribution degree at the iteration termination are compared, if the node contribution degree is greater than the link contribution degree, the abnormal root is a node anomaly, and the power equipment corresponding to the suspect object node with the highest total contribution degree at the iteration termination is a faulty equipment, if the node contribution degree is less than the link contribution degree, the abnormal root is a link anomaly, and the physical connection or the communication connection between the suspect object node with the highest total contribution degree at the iteration termination and the corresponding abnormal node is abnormal.

[0053] Further, the mathematical expression of the total contribution degree is as follows:

[0054]

[0055] and are weight coefficients of the node contribution degree and the link contribution degree respectively, is the node contribution degree, is the link contribution degree, and:

[0056]

[0057]

[0058] wherein, is the original anomaly score of the abnormal node i, is the first counterfactual anomaly score of the abnormal node i corresponding to the suspect object node j, is the second counterfactual anomaly score of the abnormal node i corresponding to the suspect object node j.

[0059] Further, the iteration termination condition comprises:

[0060] ​The total contribution degree of the suspect object node with the highest total contribution degree is lower than a preset minimum contribution threshold, or the suspect object node with the highest total contribution degree is a known top node in the power grid topology, or the number of iterations reaches a preset maximum traceability depth.

[0061] The application further provides an electric power data anomaly identification and traceability system, including a processor and a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by the processor to realize the steps of the electric power data anomaly identification and traceability method.

[0062] Compared with the prior art, the application has the following advantages:

[0063] The application realizes efficient expression of the power equipment topology relationship and dynamic focusing of the key nodes by constructing a graph structure and using an attention mechanism, provides a benchmark for anomaly analysis in combination with time mode learning, and thus accelerates the traceability process. Meanwhile, the application accurately identifies abnormal points by dynamically calculating abnormal scores, verifies the traceability path by using double counterfactual reasoning, and improves the equipment state description capability by multi-dimensional feature fusion, so as to ensure the accuracy of the diagnosis result and significantly improve the quality of power grid data governance. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 A brief flowchart of the method of the embodiment of the application.

[0065] Figure 2 A detailed flowchart of the method of the embodiment of the application.

[0066] Figure 3 A structural block diagram of the system of the embodiment of the application. DETAILED DESCRIPTION

[0067] The application will be further described below in combination with the accompanying drawings and specific preferred embodiments, but the protection scope of the application is not limited by this.

[0068] Embodiment one

[0069] In order to solve the problems that the abnormal identification model in the prior art cannot accurately capture the periodicity of the electric power data, and cannot distinguish between equipment and link faults during traceability, the embodiment provides an electric power data anomaly identification and traceability method, which accurately identifies data anomalies by using a graph time sequence model that combines power grid physical topology constraints and multi-scale periodicity priori; when an anomaly is monitored, a chain attribution algorithm is guided by the internal attention flow of the model, and a double counterfactual reasoning is used to quantitatively distinguish and locate node state anomalies or link transmission anomalies as the root cause.

[0070] As shown in Figure 1 The method includes the following steps:

[0071] S1: Obtain device operation data and topology information in a power system, and construct an association relationship between devices based on the same, specifically, obtain operation data and topology information of power devices and construct a graph structure, nodes in the graph structure correspond to power devices one by one, and each node has a feature vector of the corresponding power device, the feature vector includes time series data of indexes of the power device, if two power devices are directly connected, there is an edge between the corresponding nodes in the graph structure and they are adjacent nodes;

[0072] S2: A pre-trained graph time series model deeply integrating power grid physical constraints and periodic priori is used as an intelligent identification model to analyze the operation data and the association relationship, which can not only accurately identify data anomalies, but also quantify the severity of anomalies through a multivariate weighting mechanism, specifically, the graph structure is input into the trained graph time series model, the graph time series model calculates attention coefficients between each node and its neighbor nodes in the graph structure, the spatial features of each node are obtained by weighting and summing the feature vectors of all neighbor nodes of the same node according to the attention coefficients, the spatial feature historical sequence of each node is obtained and time pattern learning is performed to obtain corresponding index prediction values, and the corresponding anomaly scores are calculated according to the index prediction values and the index observation values of each node;

[0073] S3: When an anomaly is monitored, a chain causal attribution algorithm is guided by the attention flow generated internally in the identification process to perform double counterfactual reasoning on the suspect object, so as to clearly distinguish and finally determine the root cause of the anomaly, specifically, when the anomaly score is greater than the dynamic threshold, the corresponding node is determined as an abnormal node, and the operation data of the power device corresponding to the abnormal node is abnormal, the upstream neighbor nodes are selected as suspect object nodes in the order of the attention coefficients between the abnormal node and its neighbor nodes from large to small, and double counterfactual reasoning is performed from the suspect object nodes to obtain the abnormal root cause result of the abnormal node.

[0074] Through the above steps, the method can realize automatic and accurate identification of massive and heterogeneous power data, and quickly and accurately trace and locate the root cause of the anomaly after the anomaly is found, thereby fundamentally improving the efficiency and quality of power grid data governance.

[0075] The steps are described in detail below.

[0076] In step S1 of the embodiment, the operation data and topology information of the power devices are obtained from multiple data sources such as power enterprise power information collection master station, marketing business system, GIS (geographic information system) and the like through a pre-set interface, and the device operation data and device archives and topology information within a specified range are obtained, specifically including:

[0077] Running data: mainly the time series data of smart electric energy meter, for example, the indicators of a certain electric meter i at time t can be expressed as a feature vector , wherein P is active power, Q is reactive power, U is voltage, and I is current.

[0078] Topology information: mainly the physical connection and logical attribution relationship between devices, for example, the hierarchical relationship such as "electric meter A -> collector B -> concentrator C -> master station".

[0079] Based on the obtained topology information, the local network of the power grid is constructed into a graph structure G=(V, E), wherein:

[0080] Node (Vertices) V: represents the power devices in the network, such as electric energy meter, collector, concentrator, etc. Each node has the feature vector described above.

[0081] Edge (Edges) E: represents the association relationship between devices. For example, if device i and device j are directly connected in physics or communication, there is an edge .

[0082] Step S2 of the embodiment aims to solve the technical problems that the conventional method is difficult to capture the complex multi-scale periodicity of power data, and the recognition accuracy is insufficient due to ignoring the physical topology constraints of the power grid. A graph time series model deeply fused with periodicity priori and physical weighting is used to accurately learn the operation mode of the power device under normal working condition, so as to identify any abnormal data deviating from the mode. Specifically, the following steps are included:

[0083] S21: spatial correlation aggregation with physical constraints:

[0084] At any time t, in order to accurately capture the mutual influence between each device node in the power grid, the graph time series model first uses an improved graph attention network (GAT) layer to aggregate the neighborhood spatial information of each node. In order to avoid the complete dependence on data-driven learning of the influence weight between nodes in the prior art, the graph time series model of the embodiment introduces a physical proximity bias based on the electrical distance calculation between devices when aggregating the spatial correlation information between devices. The physical topology constraints of the power grid are explicitly injected into the attention calculation process to correct the influence weight between devices.

[0085] Specifically, the calculation process of the attention coefficient between each node and its neighbor node in the graph structure is as follows:

[0086] First, the basic attention score

[0087]

[0088] where LeakyReLU is the ReLU activation function with leakage, is a learnable attention vector is the transpose of is a learnable weight matrix, and are the feature vectors of nodes i and j, respectively.

[0089] Then, a physical proximity bias is introduced to correct the attention score :

[0090]

[0091] where is the bias term calculated according to the electrical distance between nodes i and j, for example:

[0092]

[0093] Here is a learnable scale parameter to adjust the penalty strength of the physical distance on the attention score. It can be calculated according to the line impedance, transformer parameters, etc. This bias term ensures that devices with closer electrical connections receive higher initial attention in the model. Finally, the corrected score is normalized by the softmax function to obtain the final attention coefficient:

[0094]

[0095] where denotes the attention coefficient between the i-th node and its neighbor node j in the graph structure, denotes the normalization of the attention score by the softmax function.

[0096] After obtaining the attention coefficient, the neighbor information is aggregated to generate node features that incorporate spatial information. The mathematical expression of the spatial feature of each node is as follows:

[0097]

[0098] where denotes the attention coefficient between the i-th node and its neighbor node j in the graph structure, is a learnable weight matrix, is the feature vector of node j, is the total number of neighbor nodes of the i-th node in the graph structure.

[0099] With the improvement of the above formulas 2 and 3, the spatial correlation learned by the graph time series model is no longer only the apparent correlation of the data, but more deeply simulates the distribution rule of power flow in the real physical network, laying a solid foundation for subsequent accurate prediction and tracing;

[0100] S22: Time pattern learning by fusing multi-scale periodicity:

[0101] The power load data has significant multi-scale periodicity such as day and week. To accurately capture this characteristic, the graph time series model of the embodiment adopts a specially designed periodicity-aware Transformer encoder to learn the time pattern of the spatial feature sequence generated in the previous link .

[0102] Specifically, when obtaining the spatial feature history sequence of each node and learning the time pattern, the following steps are included:

[0103] Replace the sinusoidal position encoding in the standard Transformer with multi-dimensional periodic position encoding. In the embodiment, a multi-dimensional periodic position encoding is designed at the input end of the graph time series model to replace the sinusoidal position encoding in the standard Transformer, so that the multi-dimensional periodic position encoding is used to represent the time attribute of the power equipment operation data of the node. The multi-dimensional periodic position encoding decomposes the absolute timestamp t into multiple time dimensions with clear physical meaning, and the mathematical expression is as follows:

[0104]

[0105] wherein and are learnable embedding layers for hours (0-23) and days (1-7) of the day, respectively. This encoding method directly gives the model strong periodicity prior knowledge of the power system.

[0106] On this basis, in order to obtain the fusion sequence finally input to the Transformer encoder, the embodiment explicitly fuses the node time series features obtained by spatial side aggregation with the periodic position encoding. Let the spatial aggregation output be:

[0107]

[0108] For each time step , define the corresponding input feature as:

[0109]

[0110] where, is the spatial side feature, representing the spatial feature of the i-th node in the graph structure at time step , , , is the learnable parameter, is the nonlinear activation function, is the multi-dimensional periodic position encoding at time step . The input sequence of the Transformer encoder is thus mathematically expressed as follows:

[0111]

[0112] where, are the input features at each time step, respectively.

[0113] The input sequence is then input into the Transformer encoder. First, the query, key, and value matrices are obtained by three sets of learnable linear mappings:

[0114]

[0115] where, is the learnable parameter matrix, is the feature dimension of the attention space, used for scale normalization of the dot-product attention scores to prevent the attention distribution from being overly concentrated, thereby improving the stability of model training.

[0116] In this embodiment, the Transformer encoder self-attention mechanism is modified into a periodic sparse self-attention mechanism, so as to prioritize the processing of historical data with periodic relationships by using the periodic sparse self-attention mechanism. Specifically, a fixed periodic bias matrix is introduced when calculating the attention score matrix .

[0117]

[0118] The periodic bias matrix is a T x T matrix, and the value of its element is set based on the time interval between time steps i and j. When is a multiple of 24 hours or 7 x 24 hours, is assigned a large positive value (e.g., 0), otherwise it is assigned a very large negative value (e.g., -1e9). This makes the graph time series model prioritize the data points at the same time of day when learning time dependence, thereby accurately capturing the periodicity of normal power consumption patterns.

[0119] The output obtained after the calculation using the above periodic sparse self-attention mechanism is denoted as: It should be noted that this output is an intermediate result from within the Transformer encoder. The graph time-series model in this embodiment further employs standard residual connections, layer normalization, and feed-forward network structures for nonlinear transformation and stabilization to obtain the encoded representation for each time step:

[0120]

[0121] in, To fuse corresponding features from the input sequence, This is the output of the attention sublayer. Through this processing, the graph time series model can enhance its ability to represent complex periodic patterns while maintaining the stability of temporal features.

[0122] The graph time-series model in this embodiment employs a causal masking mechanism in the time dimension, using only historical and current information for inference to ensure the consistency of the model's predicted temporal causality. For example, for the current time t, the final encoded representation is taken. As a node The comprehensive characteristic representation at time t.

[0123] Based on the encoded representation at each time step, a predicted value vector corresponding to the physical quantity dimension is obtained through a linear mapping layer. Each component in the predicted value vector is the prediction result of different indicators. The mathematical expression of the predicted value vector is as follows:

[0124]

[0125] in, and For learnable parameters, Let represent the predicted value vector of the i-th node in the graph structure at time step t. This represents the encoded representation of the i-th node in the graph structure at time step t. Each component corresponds to the prediction results of multiple physical quantities such as voltage, current, and active power.

[0126] S23: Calculation of outlier scores based on multivariate weighting:

[0127] To make the quantitative assessment of anomalies more aligned with the actual needs of power grid safe operation, this embodiment calculates anomaly scores based on multivariate weighted averages. Instead of treating all physical quantities' prediction errors equally, different weights are assigned according to their importance. The mathematical expression for calculating the corresponding anomaly score based on the predicted and observed values ​​of each node's indicators is as follows:

[0128]

[0129] in, Let represent the anomaly score of the i-th node in the graph structure at time step t. Let m represent the observed value of index m of the i-th node in the graph structure at time step t. Let m represent the predicted value of index m for the i-th node in the graph structure at time step t. This represents the weighting coefficient corresponding to index m. This coefficient is set based on the power grid operation regulations, for example, the weighting of voltage. (Set to 0.5) should be significantly higher than the weight of active power. (Set to 0.2), because voltage stability is crucial to power grid safety. These represent different indicators, where U is voltage, I is current, and P is active power.

[0130] The abnormal score calculated using Formula 13 It can more realistically reflect the actual threat level of the anomaly to power grid security, and solves the technical problem that traditional mean square error cannot effectively assess the severity of the anomaly.

[0131] like Figure 2 As shown, in step S3 of this embodiment, the abnormal score calculated in the previous step is... With a dynamic threshold Compare. If If the data is deemed normal, the process will proceed to the end (e.g., ...). Figure 2 (The "no" branch). If If the data is abnormal, a chain-like causal attribution process is initiated (e.g., ...). Figure 2 (The "is" branch).

[0132] In this embodiment, the dynamic threshold The threshold can be set based on the statistical distribution of historical anomaly scores. Correspondingly, after calculating the corresponding anomaly score based on the predicted and observed values ​​of the indicators for each node, the calculation also includes: calculating the dynamic threshold, the mathematical expression of which is as follows:

[0133]

[0134] in, For dynamic thresholds, and are the mean and standard deviation of the abnormal score in a cycle under normal conditions, respectively, is an adjustable parameter (e.g., k = 3).

[0135] As shown in Figure 2 In this embodiment, the chainwise causal attribution process is based on attention flow guidance, aiming to accurately and efficiently locate the root cause from numerous possible factors causing the anomaly. To overcome the multiple technical challenges faced by the prior art when applying counterfactual reasoning to large-scale power network tracing, such as low computational efficiency, unreasonable counterfactual construction scenarios, and inability to clearly distinguish between device faults (node anomalies) and communication connection problems (link anomalies). This embodiment proposes a chainwise causal attribution algorithm that combines attention flow and dual counterfactual reasoning. The core idea of this algorithm is to use the attention flow generated by the step S2 recognition model as an efficient guide, and use dual counterfactual reasoning for detailed attribution analysis of the suspect object, in an iterative manner to trace upwards, and ultimately determine the unique root type and propagation path. Among them:

[0136] The idea of dual counterfactual reasoning is as follows:

[0137] Two counterfactual scenarios are constructed respectively for the suspect object under normal operating conditions and normal communication conditions.

[0138] Based on the two counterfactual scenarios, the node contribution degree quantifying the contribution of device faults and the link contribution degree quantifying the contribution of data transmission link faults are calculated.

[0139] The idea of chainwise attribution algorithm is as follows:

[0140] The attention flow is used to determine the suspect object from the upstream device.

[0141] Based on the comprehensive evaluation of the node contribution degree and the link contribution degree, the upstream node with the highest contribution is determined.

[0142] And the upstream node with the highest contribution is taken as a new abnormal starting point for iterative tracing until the preset termination condition is met.

[0143] Specifically, combining the above ideas, the upstream neighbor nodes are selected as suspect object nodes in order of decreasing attention coefficients between the abnormal node and its neighbor nodes, and the dual counterfactual reasoning starts from the suspect object node, including the following steps:

[0144] S31: upstream neighbor node suspect positioning based on attention flow:

[0145] To avoid the huge computational overhead of exhaustive counterfactual reasoning on all upstream devices of the abnormal node i, in this embodiment, first, the attention weights generated when performing spatial correlation aggregation in step S2 are used to efficiently screen suspicious objects. Among them, consistent with the definition in the aforementioned formula (4) (i.e., for the upstream node j to the downstream node i at the current time t (i.e., the influence of the upstream node j). According to the weight, the top K (for example, K = 3) upstream neighbor nodes are selected as the "first-level suspicious object set" , thereby significantly reducing the search space of the traceability and improving the computational efficiency.

[0146] S32: Double counterfactual reasoning and contribution quantification:

[0147] To clearly distinguish whether the root cause is the abnormal state of the node itself or the abnormality of the link in the data transmission process, the embodiment performs twice counterfactual reasoning of different types on each suspicious object . The essence of counterfactual reasoning here is to answer "whether the anomaly will still occur if there is no suspicious factor?".

[0148] For this purpose, the device feature vector is divided into two parts: representing the device operating state data (such as voltage, current value), representing the device communication state data (such as reporting success rate, etc.). The operating state data and communication state data are obtained from the feature vector of each suspicious object node.

[0149] Then, the node contribution is calculated: the first counterfactual reasoning is performed to construct a scenario in which the node j itself is in a normal operating state. The specific method is to replace the operating state data of each suspicious object node j with the normal reference value (for example, obtained by interpolation of its healthy neighbors), thereby updating the original graph structure to the first counterfactual graph corresponding to each suspicious object node , taking each first counterfactual graph as a new graph structure, and again performing step S2 to re-input the new graph structure into the graph temporal model to obtain the first counterfactual anomaly score of the abnormal node i corresponding to each suspicious object node j , according to the original anomaly score of the abnormal node i and the first counterfactual anomaly score , the node contribution corresponding to each suspicious object node is calculated, and the node contribution is defined as the drop rate of the anomaly score, and the mathematical expression is as follows:

[0150] ​

[0151] wherein, is the original anomaly score of the anomaly node i, is the first counterfactual anomaly score of the anomaly node i corresponding to the suspect object node j;

[0152] Further calculation of the link contribution degree : Perform a second counterfactual reasoning to construct a scenario in which the transmission link downstream of the hypothetical node j is normal. Specifically, replace the communication state data of each suspect object node j with ideal values (e.g., a 100% reporting success rate), thereby updating the original graph structure to a second counterfactual graph corresponding to each suspect object node, take each second counterfactual graph as the new graph structure, and perform step S2 again to input the new graph structure into the graph temporal model to obtain the second counterfactual anomaly score of the anomaly node i corresponding to each suspect object node j, calculate the link contribution degree corresponding to each suspect object node according to the original anomaly score of the anomaly node and the second counterfactual anomaly score

[0153] , and the mathematical expression is as follows:

[0154] wherein, is the original anomaly score of the anomaly node i, is the second counterfactual anomaly score of the anomaly node i corresponding to the suspect object node j;

[0155] S33: Root cause determination and chain iteration:

[0156] According to the chain attribution algorithm, trace back along the path with the highest contribution degree until the root cause is located through an iterative process. Specifically, the following steps are included:

[0157] First, calculate the total contribution degree of each suspect object node to determine the most important upstream influence source. Specifically, calculate the total contribution degree corresponding to the same suspect object node according to the node contribution degree and the link contribution degree, and in this embodiment, the total contribution degree is defined as the weighted sum of the node and link contribution degrees:

[0158]

[0159] wherein and are weight coefficients, which can be set according to operation and maintenance experience, for example = 0.7, = 0.3, indicating that more emphasis is placed on the state anomaly of the device itself.

[0160] In the suspect object set , find the total contribution of the suspect object node with the highest total contribution, denoted as , if the termination condition is not met, consider as a new abnormal node, jump to step S31 and execute again the step of selecting upstream neighbor nodes as suspect object nodes in the order of attention coefficients between abnormal nodes and their neighbor nodes from large to small to trace upstream suspect object nodes, until any one of the following conditions is met, then the iteration is terminated:

[0161] (a) The total contribution of is lower than a preset minimum contribution threshold (for example, 0.1), indicating that the causal relationship traced upwards is very weak;

[0162] (b) is a known top node (such as a concentrator or master station) in the power grid topology;

[0163] (c) The number of iterations has reached a preset maximum trace depth (for example, 5 layers);

[0164] When the iteration is terminated, the abnormal root cause is determined by comparing the node contribution and the link contribution of the suspect object node with the highest total contribution at the time of iteration termination, if , i.e. the node contribution is greater than the link contribution, then the root cause is finally determined as a node anomaly, and the corresponding power device of the suspect object node with the highest total contribution at the time of iteration termination is the faulty device, if , i.e. the node contribution is less than the link contribution, then the root cause is finally determined as a link anomaly, and the physical connection or communication connection between the suspect object node with the highest total contribution at the time of iteration termination and the corresponding abnormal node i is abnormal.

[0165] In this embodiment, after step S3, the node anomaly information obtained through step S2 and the abnormal trace result obtained through step S3 can also be collected and integrated into a structured report. For example, a report can include: abnormal device number, abnormal occurrence time, abnormal type, abnormal score, and a root cause chain list sorted by contribution, such as “[root cause 1: concentrator C001 communication interruption, contribution: 0.89]; [root cause 2: upper line voltage slight overrun, contribution: 0.11]”. The report can be stored in a database, displayed on a system interface, or sent to an operation and maintenance personnel through a short message, an email, or the like. ​​

[0166] Embodiment Two

[0167] The embodiment proposes an electric power data anomaly identification and tracing system, comprising a processor and a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the electric power data anomaly identification and tracing method in Embodiment One.

[0168] As shown in Figure 3 , the system of the embodiment comprises the following functional modules:

[0169] A data processing module 10 is configured to acquire the operation data of a target device and the topology information between devices in an electric power system through step S1 of Embodiment One, and construct the correlation between devices based on the topology information;

[0170] An anomaly identification module 20 is connected with the data processing module 10, and has an intelligent identification model based on a pre-trained graph time sequence model deeply fused with power grid physical constraints and periodicity priori, which is configured to identify the data anomaly of the target device according to the correlation and the operation data through step S2 of Embodiment One, and calculate an anomaly score based on a multivariate weighting method; and further configured to send the anomaly event information containing the initial anomaly node ID, time stamp and original anomaly score to a root cause tracing module 30 when the anomaly score is greater than a dynamic threshold, as shown in Figure 3 The anomaly identification module 20 simultaneously transmits the dual information interaction of anomaly alarm signal and internal attention flow to the root cause tracing module 30;

[0171] The root cause tracing module 30 is connected with the anomaly identification module 20, and is configured to activate a chain attribution algorithm when the data anomaly is identified through step S3 of Embodiment One, the algorithm is guided by the attention flow output from the anomaly identification module 20, and quantitatively distinguishes and determines the root cause causing the data anomaly by performing double counterfactual reasoning;

[0172] A result output module 40 is connected with the anomaly identification module 20 and the root cause tracing module 30, and is configured to collect the anomaly alarm information from the anomaly identification module 20 and the root cause analysis result from the root cause tracing module 30, and integrate them into a structured report, and output the anomaly node and the corresponding root cause.

[0173] In summary, the present application proposes a power data anomaly identification and tracing method, and proposes a system for executing the steps of the method. Through a graph temporal model that combines power grid physical topology constraints and multi-scale periodicity priors, data anomalies are accurately identified. When an anomaly is detected, a chain attribution algorithm is guided by the internal attention flow of the model, and through double counterfactual reasoning, node state anomalies or link transmission anomalies are quantified, differentiated and located as the root cause. The whole process from data access, intelligent identification to accurate tracing is automated, compared with the prior art, the present application has the following remarkable beneficial effects:

[0174] 1. High identification accuracy and wide range: through intelligent model learning of complex power consumption patterns, the present application can overcome the poor robustness of traditional threshold method, not only can identify obvious numerical out-of-limit anomalies, but also can find implicit problems such as pattern anomalies, greatly improving the accuracy and recall rate of anomaly identification.

[0175] 2. Automatic tracing, high efficiency: the present application changes the previous manual investigation work into an automatic reverse tracing process, shortens the tracing time from hours or even days to minutes, greatly improves the operation and maintenance efficiency, and liberates manpower.

[0176] 3. Accurate positioning, with evidence: by analyzing along the device association relationship and quantifying the contribution of each link, the present application can accurately locate the specific faulty device or communication link, providing a clear direction for subsequent repair and maintenance work, avoiding blind investigation.

[0177] 4. Strong adaptability: the model of the present application has self-learning ability and can adapt to the power consumption characteristics of different regions and different types of users, without the need to customize complex rules for each scene, and has strong universality and portability.

[0178] Those skilled in the art will appreciate that embodiments of the application can be readily used as software, hardware, or a combination of software and hardware. In a software embodiment, various software modules in accordance with embodiments of the application are stored in a memory such as a computer memory or disk storage for use by, or in connection with, the software on the computer system. The software can provide for programs to be transferred to another computer readable medium (e.g., a removable medium either in the form of computer disks or other hardware) for implementation of the various techniques. Particular software modules can be designed to carry out the functions of embodiments of the application using standard programming techniques and / or languages. Figure 1 one or more functions specified in the flow or flows and / or blocks Figure 1 one or more functions specified in the flow or flows and / or blocks Figure 1 one or more functions specified in the flow or flows and / or blocks Figure 1 one or more functions specified in the flow or flows and / or blocks Figure 1 one or more functions specified in the flow or flows and / or blocks Figure 1 one or more functions specified in the flow or flows and / or blocks

[0179] The above description is only preferred embodiments of the application. The protection scope of the application is not limited to the above-mentioned embodiments. Any technical scheme falling within the concept of the application shall be considered as falling within the protection scope of the application. It should be noted that some improvements and refinements made by those skilled in the art without departing from the principles of the application shall also be considered as falling within the protection scope of the application.

Claims

1. A method for identifying and tracing power data anomalies, characterized in that, The method comprises the following steps: S1: obtaining operation data and topology information of power equipment and constructing a graph structure, nodes in the graph structure correspond to power equipment one by one, and each node has a feature vector of the corresponding power equipment, the feature vector comprises time series data of indexes of the power equipment, if two power equipments are directly connected, there is an edge between the corresponding nodes in the graph structure and the nodes are adjacent to each other; S2: inputting the graph structure into a trained graph time series model, the graph time series model calculates attention coefficients between each node and its neighbor nodes in the graph structure, weights and sums feature vectors of all neighbor nodes of the same node according to the attention coefficients, obtains spatial features of each node, further obtains a historical sequence of the spatial features and performs time pattern learning to obtain a corresponding index prediction value, and calculates a corresponding anomaly score according to the index prediction value and an observed value of each node; S3: if the anomaly score is greater than a dynamic threshold, the corresponding node is an abnormal node, in a case where there is an abnormal node and operation data of the power equipment corresponding to the abnormal node is abnormal, upstream neighbor nodes are selected as suspect object nodes in the order of the attention coefficients between the abnormal node and the neighbor nodes from large to small, and double counterfactual reasoning is performed from the suspect object nodes to obtain an abnormal root cause result of the abnormal node, wherein the double counterfactual reasoning from the suspect object nodes comprises the following steps: obtaining operation state data and communication state data from a feature vector of each suspect object node; replacing the operation state data of each suspect object node with a normal reference value, thereby updating the graph structure into a first counterfactual graph corresponding to each suspect object node, taking each first counterfactual graph as a new graph structure, and performing step S2 again to obtain a first counterfactual anomaly score of the abnormal node corresponding to each suspect object node, and calculating a node contribution degree corresponding to each suspect object node according to the original anomaly score and the first counterfactual anomaly score of the abnormal node; replacing the communication state data of each suspect object node with an ideal value, thereby updating the graph structure into a second counterfactual graph corresponding to each suspect object node, taking each second counterfactual graph as a new graph structure, and performing step S2 again to obtain a second counterfactual anomaly score of the abnormal node corresponding to each suspect object node, and calculating a link contribution degree corresponding to each suspect object node according to the original anomaly score and the second counterfactual anomaly score of the abnormal node; calculating a total contribution degree corresponding to the same suspect object node according to the node contribution degree and the link contribution degree, taking the suspect object node with the highest total contribution degree as a new abnormal node, and performing again the step of selecting upstream neighbor nodes as suspect object nodes in the order of the attention coefficients between the abnormal node and the neighbor nodes from large to small to trace upstream suspect object nodes until an iteration termination condition is met. The node contribution degree and the link contribution degree of the suspect object node with the highest total contribution degree at the iteration termination are compared, if the node contribution degree is greater than the link contribution degree, the abnormal root is a node abnormality, the power equipment corresponding to the suspect object node with the highest total contribution degree at the iteration termination is the fault equipment, if the node contribution degree is less than the link contribution degree, the abnormal root is a link abnormality, and the physical connection or the communication connection between the suspect object node with the highest total contribution degree at the iteration termination and the corresponding abnormal node is abnormal.

2. The method of claim 1, wherein, The mathematical expression of the attention coefficient between each node and its neighbor node in the graph structure is as follows: wherein, represents the attention coefficient between the i-th node and its neighbor node j in the graph structure, represents the normalized attention score by the softmax function , represents the corrected attention score between the i-th node and its neighbor node j, and the mathematical expression is as follows: wherein, the original attention score between the i-th node and its neighbor node j, is computed according to the electrical distance between nodes i and j the bias term computed as: where LeakyReLU is a ReLU activation function with leakage, is a learnable attention vector is the transpose of is a learnable weight matrix, and are the feature vectors of nodes i and j, respectively, is a learnable scale parameter.

3. The method of claim 1, wherein, The mathematical expression of the spatial feature of each node is as follows: wherein, denotes the attention coefficient between the i-th node and its neighbor node j in the graph structure, is a learnable weight matrix, is the feature vector of node j, is the total number of neighbor nodes of the i-th node in the graph structure.

4. The method of claim 1, wherein, When the spatial feature history sequence of each node is obtained and time pattern learning is performed, the following steps are included: The multi-dimensional periodic position encoding is used to replace the sine position encoding in the standard Transformer, and the mathematical expression of the multi-dimensional periodic position encoding is as follows: wherein and are learnable embedding layers for hours of the day and days of the week respectively; For each time step , the input sequence to the Transformer encoder is computed, mathematically expressed as follows: wherein, are the input features for each time step, respectively, and the mathematical expression is as follows: wherein, is the spatial side feature, representing the spatial feature of the i-th node in the graph structure at time step , , , is a learnable parameter, is a non-linear activation function, is a multi-dimensional periodic positional encoding at time step ; The input sequence is input to the Transformer encoder to obtain an encoded representation at each time step, mathematically expressed as follows: wherein, is the output of the attention sublayer, denoted as and: wherein, are respectively the query, key and value matrices, , are learnable parameter matrices, is the feature dimension of the attention space, is a periodic bias matrix whose elements are set based on the time interval between time steps i and j , when is a multiple of 24 hours or 7x24 hours, is given a positive value, otherwise a negative value, the order of magnitude of which is greater than that of the positive value; Based on the encoding representation of each time step, a corresponding prediction value vector is obtained through a linear mapping layer, each component in the prediction value vector is a prediction result of a different index, and the mathematical expression of the prediction value vector is as follows: wherein, and are learnable parameters, denotes the predicted value vector of the i-th node in the graph structure at time step t, denotes the encoded representation of the i-th node in the graph structure at time step t.

5. The method of claim 1, wherein, When the abnormal score corresponding to each node is calculated according to the index prediction value and the index observation value, the mathematical expression is as follows: wherein, represents the anomaly score of the i-th node in the graph structure at time step t, represents the observed value of the indicator m of the i-th node in the graph structure at time step t, represents the predicted value of the indicator m of the i-th node in the graph structure at time step t, represents the weight coefficient corresponding to the indicator m, represents different indicators, wherein U is voltage, I is current, and P is active power.

6. The method of power data anomaly identification and tracing of claim 1, wherein, After the abnormal score corresponding to each node is calculated according to the index prediction value and the index observation value, the following steps are further included: calculating a dynamic threshold, and the mathematical expression is as follows: wherein, is a dynamic threshold, and are the mean and standard deviation of the abnormality score over a period under normal operating conditions, respectively, is an adjustable parameter.

7. The method of power data anomaly identification and tracing of claim 1, wherein, The mathematical expression of the total contribution degree is as follows: wherein, and are weight coefficients of node contribution and link contribution, respectively, is the node contribution, is the link contribution, and: wherein, is the original anomaly score of the anomaly node i, is the first counterfactual anomaly score of the anomaly node i corresponding to the suspect node j, is the second counterfactual anomaly score of the anomaly node i corresponding to the suspect node j.

8. The method of power data anomaly identification and tracing of claim 1, wherein, The iteration termination condition includes: The total contribution degree of the suspect object node with the highest total contribution degree is lower than a preset minimum contribution threshold, or the suspect object node with the highest total contribution degree is a known top node in the power grid topology, or the iteration number reaches a preset maximum traceability depth.

9. An electric power data anomaly identification and tracing system, characterized in that, The computer program is stored in the computer readable storage medium and is executed by the processor to implement the steps of the power data anomaly identification and traceability method in any one of claims 1-8.

Images