Electric energy metering device abnormity early warning method combined with edge calculation

Abstract

The invention provides an electric energy metering device abnormity early warning method combined with edge computing in the technical field of intelligent operation and maintenance of electric energy metering equipment, and the method comprises the steps: S1, carrying out the training and compression of a device abnormity detection model, constructing a teacher model and a student model, and respectively deploying the teacher model and the student model to a region node and an electric energy metering device; s2, the electric energy metering device collects real-time device monitoring data and inputs the real-time device monitoring data into the student model to obtain a student detection result, the student detection result and the real-time monitoring data are encrypted into a first encrypted data packet, and an abnormal response is executed based on the student detection result, or the first encrypted data packet is sent to the regional node; and S3, the regional node inputs the real-time monitoring data into the teacher model based on the student detection result to obtain a teacher detection result, executes an abnormal response based on the teacher detection result, or encrypts the teacher detection result into an abnormal early warning notice and sends the abnormal early warning notice to the server. The method has the advantages that the accuracy, timeliness and safety of abnormal early warning of the electric energy metering device are greatly improved.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology for power metering equipment, and in particular to an anomaly early warning method for power metering devices that combines edge computing. Background Technology

[0002] With the deepening implementation of the digital grid strategy, the digital transformation of the energy and power sector has moved from conceptual exploration to practical application. The digital transformation of the metering system, with its powerful data acquisition, processing, and analysis capabilities, is becoming a key path to promote the modernization and upgrading of metering services, reduce the burden of grassroots operation and maintenance, and improve service efficiency. In recent years, with the advancement of smart grid construction and power market reform, the scale of dedicated lines and transformer users under the jurisdiction of power supply companies has increased significantly, leading to a surge in the number of on-site installations of electricity metering devices. Although supporting intelligent applications (such as remote meter reading, online monitoring, and preliminary fault analysis) have improved convenience, the complex operation and maintenance challenges arising from the massive deployment of these devices have also become increasingly prominent.

[0003] In the field of electricity metering device operation and maintenance, the traditional model mainly relies on servers to remotely collect monitoring data from the devices, conduct preliminary fault analysis based on this data, and combine this with regular inspections by maintenance personnel and passive repair reporting by users. However, when faced with a large-scale and geographically distributed group of devices, this model exhibits significant limitations: the growth rate of personnel cannot keep up with the surge in the number of devices, and relying on manual inspections or regular rotations is not only costly and inefficient, but also makes it difficult to achieve broad coverage and high-frequency refined operation and maintenance for a massive number of devices, resulting in many devices being in a state of extensive management for a long time. More importantly, the existing technology system has multi-layered systemic defects in ensuring the core requirements for the normal operation of devices—namely, the accuracy, timeliness, and security of anomaly warnings—which constitute a bottleneck for practical application. 1. The accuracy of early warnings is significantly flawed: 1.1 Insufficient monitoring dimensions lead to false alarms and missed alarms: Existing centralized monitoring mainly relies on simple threshold judgments based on a limited number of key parameters transmitted (such as voltage, current, power, and electrical quantity). This single-dimensional judgment method cannot accurately identify early fault signals caused by subtle abnormalities in internal circuits, components, or software (such as slight drift, changes in specific harmonic components, intermittent abnormalities in internal communication, and component performance degradation). These weak signals are easily filtered out by broad thresholds or buried in background noise.

[0004] 1.2 Static rules suffer from poor adaptability and lack of intelligent judgment: Pre-set fixed alarm rules are mostly based on idealized conditions or limited historical data. They are severely inadequate in adapting to complex and variable real-world environments (such as load fluctuations, special power conditions, extreme weather, and external interference) as well as individual differences and aging characteristics of equipment. This leads to frequent false alarms triggered by non-fault fluctuations, or the failure to identify actual dangerous equipment conditions (missed alarms). Furthermore, the lack of machine learning capabilities based on massive operational data and equipment mechanism models prevents autonomous learning of dynamic fault modes and makes it difficult to effectively distinguish between normal fluctuations and potential hazards.

[0005] 1.3 Data noise interference affects the accuracy of status identification: The complex electromagnetic environment at the device's operating site is prone to noise interference during data acquisition and transmission. Under a centralized processing architecture, raw data is often transmitted remotely without sufficient cleaning, and the information received by the server may contain "impurities," leading to distorted judgments. Furthermore, insufficient deep sensing capabilities regarding critical operating states within the device (such as key chip temperature, real-time load rate, memory / storage usage, and communication signal quality) limit the ability to identify potential hazards.

[0006] 2. The timeliness of early warnings is severely delayed: 2.1 The centralized processing architecture has too long a latency: The current centralized data processing model of "end-to-communication network-to-server" requires all data to be transmitted through multiple levels of network (such as from the field network to the data center), which results in an end-to-end latency of minutes or even higher from the occurrence of an anomaly to the generation of an alarm.

[0007] 2.2 Challenges in Response and Scheduling for Critical Scenarios: For severe anomalies (such as malicious faults, human sabotage, or events threatening power grid safety), the aforementioned time delays severely compress the emergency response window, expand the scope of the fault's impact, and significantly increase the risk of loss. At electricity market transaction settlement points, the real-time accuracy of metering data is crucial; if missing or erroneous data is not addressed promptly, it can easily lead to transaction disputes and economic losses.

[0008] 2.3 Data processing bottlenecks exacerbate response delays: As the number of access points and the granularity of monitoring data increases, servers face enormous processing pressure. During periods of high anomaly incidence or when system resources are strained, the reception, storage, cleaning, and alarm generation of massive amounts of data can easily become bottlenecks, further extending response time and weakening the timeliness value of early warnings.

[0009] 3. Significant security risks: 3.1 Lengthy data transmission paths increase security threats: The transmission of massive amounts of data from field devices to servers requires passing through multiple network links (such as relying on wired / wireless public networks). The lengthy transmission path significantly increases the risk of data being eavesdropped, intercepted, or tampered with. Even with encryption technology, too many network boundaries greatly increase the difficulty of security management and the probability of being breached.

[0010] 3.2 Centralized data storage constitutes a single attack target: The centralized architecture aggregates all monitoring data on the server. Once the server system is compromised, attackers can obtain massive amounts of user electricity consumption information (including sensitive load patterns) and device operating status, leading to a large-scale privacy leakage risk.

[0011] 3.3 Weak edge node protection: The hardware and firmware security of devices deployed in a decentralized and remote location is often neglected (e.g., hardware security modules are not enabled, insecure firmware update mechanisms are used, and access control is insufficient), which provides convenient conditions for edge node intrusion, malicious code injection, or data tampering.

[0012] The common consequence of the aforementioned systemic defects is that, due to a lack of accurate, rapid, and secure continuous monitoring capabilities, many electricity metering devices, within their statutory verification period, fail to promptly identify early potential faults caused by factors such as loose wiring, insulation degradation, transformer characteristic distortion, clock inaccuracy, or software anomalies. These potential faults may ultimately develop into irreversible electricity metering errors or data loss, causing not only direct economic losses and transaction anomalies but also seriously threatening the fairness of the electricity market, the stability of the power grid, and users' trust in metering services. Therefore, how to provide an anomaly early warning method for electricity metering devices that combines edge computing to improve the accuracy, timeliness, and security of anomaly early warning has become an urgent technical problem to be solved. Summary of the Invention

[0013] The technical problem to be solved by the present invention is to provide an abnormal early warning method for electricity metering devices that combines edge computing, thereby improving the accuracy, timeliness and security of abnormal early warning for electricity metering devices.

[0014] This invention is implemented as follows: (The steps are as follows:) Step S1: Create a device anomaly detection model based on the data preprocessing layer, multimodal feature extraction layer, multi-level feature fusion layer, anomaly risk detection layer, response strategy generation layer, and output layer, and set the loss function of the device anomaly detection model. Step S2: Obtain a large amount of historical device monitoring data of electricity metering devices installed in different environments and with different service durations. The historical device monitoring data includes electrical quantity data, operating status data, environmental data, and safety probe data. After preprocessing and labeling each of the historical device monitoring data, a dataset is constructed. Step S3: Train the device anomaly detection model using the dataset and loss function. During the training process, compress the device anomaly detection model using knowledge distillation technology to construct a teacher model and a student model. Deploy the teacher model to the regional node and the student model to the power metering device connected to the regional node. Step S4: The power metering device collects real-time device monitoring data, preprocesses the real-time device monitoring data and inputs it into the deployed student model to obtain student detection results carrying student anomalies, student risk levels and student response strategies. The student detection results and the corresponding real-time monitoring data are encrypted into a first encrypted data packet. The first encrypted data packet is locally rolled storage. An anomaly response is executed based on the student detection results, or the first encrypted data packet is sent to the regional node. Step S5: The regional node decrypts the received first encrypted data packet to obtain student detection results and real-time monitoring data. Based on the student detection results, the real-time monitoring data is input into the deployed teacher model to obtain teacher detection results carrying teacher anomalies, teacher risk levels, and teacher response strategies. The teacher detection results and the corresponding real-time monitoring data are encrypted into a second encrypted data packet. The second encrypted data packet is locally rolled and stored. An anomaly response is executed based on the teacher detection results, or the teacher detection results are encrypted into an anomaly warning notification and sent to the server in real time. Step S6: The server decrypts the received anomaly warning notification to obtain the teacher detection result, and executes an emergency response based on the teacher detection result; Step S7: Update the teacher and student models using the federated learning mechanism.

[0015] Furthermore, in step S1, the data preprocessing layer is used to perform modal alignment and standardization on the input electrical quantity data, operating status data, environmental data, and safety probe data, and output a four-modal tensor sequence with unified dimensions. The multimodal feature extraction layer is constructed based on an electrical quantity feature extraction module, an operational status feature extraction module, an environmental feature extraction module, and a safety probe feature extraction module. The electrical quantity feature extraction module extracts electrical quantity features from the four-modal tensor sequence using a temporal convolutional network and a bidirectional GRU. The operational status feature extraction module extracts operational status features from the four-modal tensor sequence using a graph convolutional network. The environmental feature extraction module extracts environmental features from the four-modal tensor sequence using a fully connected residual network. The safety probe feature extraction module extracts safety probe features from the four-modal tensor sequence using a multi-head self-attention network. The multi-level feature fusion layer is constructed based on a primary fusion module, an intermediate fusion module, and a high-level fusion module. The primary fusion module is used to perform weighted aggregation of electrical quantity features, operating status features, environmental features, and safety probe features through a modal attention mechanism to obtain initial fused features. The intermediate fusion module is used to enhance the initial fused features with complementary information through a cross-modal interaction gate to obtain intermediate fused features. The high-level fusion module is used to treat the intermediate fused features as a time-series signal through a temporal convolutional fusion block, and extract cross-modal temporal patterns from the time-series signal using 1D convolution to obtain high-level fused features. The anomaly risk detection layer is constructed based on an anomaly detection module and a risk level prediction module. The anomaly detection module is used to infer the high-level fusion features through a Gaussian mixture variational autoencoder to obtain the anomaly probability of different anomalies. The risk level prediction module is used to infer the high-level fusion features through a three-layer cascaded fully connected layer to obtain the risk level probability distribution of different anomalies. The response strategy generation layer is used to reason about the advanced fusion features and risk level probability distribution through a conditional generative adversarial network to obtain the response strategy for anomalies. The output layer is used to output detection results carrying anomaly items, risk levels, and response strategies based on anomaly probability, risk level probability distribution, and response strategies; the risk level is low risk, medium risk, or high risk. The formula for the loss function is: ; in, This represents the loss value of the loss function; The anomaly detection sub-loss is represented by the binary cross-entropy loss function. The risk level prediction sub-loss is represented by the classification cross-entropy loss function. The response strategy generates a sub-loss, which uses the standard adversarial loss function of conditional generative adversarial networks. Both represent hyperparameters.

[0016] Furthermore, step S2 specifically includes: Acquire a large amount of historical monitoring data from electricity metering devices installed in different environments and with varying service durations; The historical device monitoring data includes electrical quantity data, operating status data, environmental data, and safety probe data; the electrical quantity data includes at least basic AC electrical quantities and power quality parameters; the operating status data includes at least hardware self-test status, software operating status, and resource usage data; the environmental data includes at least temperature, humidity, air pressure, vibration, light intensity, location information, and external magnetic field strength; and the safety probe data includes at least firmware integrity verification values ​​and safety event logs. The monitoring data of each historical device is preprocessed, including at least missing value handling, outlier handling, data alignment and time synchronization, data transformation and standardization. The preprocessed monitoring data of each historical device is labeled, including at least anomalies, risk levels and response strategies. A dataset is constructed based on the labeled monitoring data of each historical device.

[0017] Furthermore, step S3 specifically includes: The dataset is divided into a training set, a validation set, and a test set based on a preset ratio using stratified sampling. The device anomaly detection model is trained using the training set. During the training process, the device anomaly detection model is continuously optimized, including at least the learning rate, batch size, number of training rounds, number of hidden layers, number of neurons per layer, regularization parameters, and hyperparameters of the learning rate scheduling strategy, until the loss value of the loss function is less than a preset loss threshold. Precision, recall, F1-Score, AUROC, and prediction accuracy are calculated using the validation set to validate the trained device anomaly detection model. If the validation fails, the training set is expanded and training continues; if the validation passes, then: The confidence level and inference latency are calculated using the test set to test the validated device anomaly detection model. If the test fails, the training set is expanded for further training; if the test passes, then: The device anomaly detection model is used as the teacher model. A lightweight model architecture is selected as the student model based on the computational resource constraints of the power metering device. The model parameters of the student model are randomly initialized. The student model is trained using the output of the teacher model as soft labels through knowledge distillation. The trained student model is then subjected to performance verification including at least precision, recall, F1-Score, AUROC, and prediction accuracy to complete the compression of the device anomaly detection model. The teacher model is deployed to the TEE environment of the regional node, and the student model is deployed to the TEE environment of the power metering device connected to the regional node.

[0018] Furthermore, step S4 specifically includes: The electricity metering device collects real-time device monitoring data, including electrical quantity data, operating status data, environmental data, and safety probe data. The real-time device monitoring data is preprocessed by an adaptive wavelet denoising algorithm to filter out noise. The preprocessed real-time device monitoring data is then input into a deployed student model to obtain student detection results carrying student anomalies, student risk levels, and student response strategies. The electricity metering device obtains the current first timestamp and the first device serial number of the device, concatenates the first timestamp and the first device serial number into a first time series string, calculates the first hash value of the first time series string using the SHA-256 algorithm, and extracts the first 128 bits from the first hash value as a first dynamic key; concatenates the student detection results and real-time monitoring data into a first combined data block, calculates the second hash value of the first combined data block using the SHA-256 algorithm, and encrypts the first combined data block and the second hash value using the first dynamic key using the AES-128 algorithm to obtain first encrypted data; concatenates the first encrypted data, the first timestamp, and the first device serial number to obtain first concatenated data; extracts a first preset length of characters from the first timestamp based on a preset first truncation rule as a first obfuscation string, inserts the first obfuscation string into the first specified position of the first concatenated data to obtain first obfuscated data, and performs Base64 encoding on the first obfuscated data to obtain a first encrypted data packet; The electricity metering device continuously stores the first encrypted data packet to the local first hardware security module, calculates the first data fingerprint of the first encrypted data packet using the CRC32 algorithm, and uploads the first data fingerprint to the blockchain; The electricity metering device analyzes the student detection results. When the student risk level carried by the student detection results is low risk, it executes an abnormal response based on the student response strategy carried by the student detection results. Otherwise, it sends the first encrypted data packet to the regional node in real time via the TLS protocol.

[0019] Furthermore, step S5 specifically includes: The regional node receives the first encrypted data packet in real time. After obtaining the first data fingerprint from the blockchain and performing an integrity check on the first encrypted data packet, it decodes the first encrypted data packet using Base64 to obtain the first obfuscated data. Based on the first specified position and the first preset length, it locates the first obfuscated string. It removes the first obfuscated string from the first obfuscated data to obtain the first concatenated data. It parses the first concatenated data to obtain the first encrypted data, the first timestamp, and the first device serial number. It performs timeliness verification using the first timestamp and then legality verification using the first device serial number. It then concatenates the first timestamp and the first device serial number to form a first time sequence string. It calculates the first hash value of the first time sequence string using the SHA-256 algorithm. It extracts the first 128 bits from the first hash value as the first dynamic key. It calls the first dynamic key using the AES-128 algorithm to decrypt the first encrypted data to obtain the first combined data block and the second hash value. After performing a second integrity check on the first combined data block using the second hash value, it parses the first combined data block to obtain the student detection results and real-time monitoring data. The regional node parses the student detection results. When the student risk level carried by the student detection results is medium risk or high risk, the real-time monitoring data is input into the deployed teacher model to obtain the teacher detection results carrying teacher anomalies, teacher risk levels, and teacher response strategies. The teacher detection results and the corresponding real-time monitoring data are encrypted into a second encrypted data packet. The second encrypted data packet is continuously stored in the local second hardware security module. The second data fingerprint of the second encrypted data packet is calculated using the CRC32 algorithm and uploaded to the blockchain. The regional node parses the teacher detection results. When the teacher risk level carried by the teacher detection results is low or medium risk, it controls the corresponding electricity metering device to perform an abnormal response based on the teacher response strategy carried by the teacher detection results. When the teacher risk level carried by the teacher detection results is high risk, it encrypts the teacher detection results into an abnormal warning notification and sends the abnormal warning notification to the server in real time via the TLS protocol.

[0020] Furthermore, in step S5, encrypting the teacher's detection results and the corresponding real-time monitoring data into a second encrypted data packet specifically involves: The regional node obtains the current second timestamp and the second device serial number of the local machine, concatenates the second timestamp and the second device serial number into a second time series string, calculates the third hash value of the second time series string using the SHA-512 algorithm, and extracts the last 256 bits from the third hash value as the second dynamic key; concatenates the teacher detection results and real-time monitoring data into a second combined data block, calculates the fourth hash value of the second combined data block using the SHA-512 algorithm, and encrypts the second combined data block and the fourth hash value using the second dynamic key using the AES-256 algorithm to obtain second encrypted data; concatenates the second encrypted data, the second timestamp, and the second device serial number to obtain second concatenated data; based on a preset second truncation rule, extracts a second preset length of characters from the second timestamp as a second obfuscation string, inserts the second obfuscation string into the second specified position of the second concatenated data to obtain second obfuscated data, and performs Base64 encoding on the second obfuscated data to obtain a second encrypted data packet.

[0021] Furthermore, in step S5, encrypting the teacher's detection result into an anomaly warning notification specifically involves: The regional node obtains the current third timestamp and the local device serial number, concatenates the third timestamp and the second device serial number to form a third time series string, calculates the fifth hash value of the third time series string using the SHA-512 algorithm, and extracts bits 4-259 from the fifth hash value as the third dynamic key; it then calculates the sixth hash value of the teacher detection result using the SHA-512 algorithm, and uses S... M4 The algorithm calls the third dynamic key to encrypt the teacher detection result and the sixth hash value to obtain the third encrypted data. The third encrypted data, the third timestamp, and the second device serial number are concatenated to obtain the third concatenated data. Based on the preset third truncation rule, the third preset length characters are truncated from the third timestamp as the third obfuscation string. The third obfuscation string is inserted into the third specified position of the third concatenated data to obtain the third obfuscated data. The third obfuscated data is Base64 encoded to obtain the abnormal warning notification.

[0022] Furthermore, step S6 specifically includes: The server receives the abnormal warning notification in real time, decrypts and verifies the abnormal warning notification to obtain the teacher detection result, parses the teacher detection result, and when the teacher risk level carried by the teacher detection result is high risk, it automatically triggers the preset emergency response mechanism based on the preset script to execute the emergency response and pushes the emergency response notification to the pre-associated management terminal.

[0023] Furthermore, step S7 specifically includes: Each regional node constructs an incremental dataset based on real-time device monitoring data from different electricity metering devices. The incremental dataset is labeled based on received abnormal response feedback. When the data volume of the incremental dataset reaches a preset threshold, the teacher model is trained and its performance is verified using the incremental dataset. The updated parameters of the teacher model are extracted, and the updated parameters are encrypted into encrypted parameters using a homomorphic encryption algorithm. The encrypted parameters are then uploaded to the server via the TLS protocol. The server aggregates the encrypted parameters uploaded by each regional node to obtain global model parameters, and then sends the global model parameters to each regional node via the TLS protocol. Each regional node updates the teacher model based on the global model parameters, and updates the student model of the corresponding power metering device after knowledge distillation of the global model parameters.

[0024] The advantages of this invention are: 1. A device anomaly detection model is created through a data preprocessing layer, a multimodal feature extraction layer, a multi-level feature fusion layer, an anomaly risk detection layer, a response strategy generation layer, and an output layer. A loss function for the device anomaly detection model is set. Then, a large amount of historical device monitoring data is acquired to construct a dataset. The device anomaly detection model is trained using the dataset and the loss function. During training, the device anomaly detection model is compressed using knowledge distillation technology to construct a teacher model and a student model. The teacher model is deployed to regional nodes, and the student model is deployed to energy metering devices connected to the regional nodes. The energy metering devices collect real-time device monitoring data, preprocess it, and input it into the student model to obtain student detection results carrying student anomaly items, student risk levels, and student response strategies. The student detection results and corresponding real-time monitoring data are encrypted into a first encrypted data packet, which is locally stored. Anomaly responses are executed based on the student detection results, or the first encrypted data packet is sent to the regional node. The regional node decrypts the first encrypted data packet to obtain the student detection results and real-time monitoring data. Based on the student detection results, the real-time monitoring data is input into the teacher model to obtain teacher detection results carrying teacher anomaly items, teacher risk levels, and teacher response strategies. The results and corresponding real-time monitoring data are encrypted into a second encrypted data packet. This second encrypted data packet is locally stored on a rolling basis. An anomaly response is executed based on the teacher's detection results, or the teacher's detection results are encrypted into an anomaly warning notification and sent to the server in real time. The server decrypts the anomaly warning notification to obtain the teacher's detection results, executes an emergency response based on the teacher's detection results, and updates each teacher model and student model through a federated learning mechanism. That is, by deploying a lightweight student model, the power metering device processes multi-source monitoring data (electrical quantities, operating status, environment, and safety probes) in real time. Combined with multimodal feature extraction and fusion technology, it captures subtle anomaly signals, achieving millisecond-level local anomaly initial judgment and response, greatly improving the timeliness of warnings. At the same time, the teacher model of the regional node performs secondary verification of the student's detection results. The dynamic deep learning model eliminates the influence of environmental interference and individual differences, significantly reducing false alarms and missed alarms, and ensuring accuracy. In addition, the use of local and regional node hierarchical data encryption, rolling storage, and federated learning update mechanisms ensures that the original monitoring data is processed only at the edge, and the server only receives encrypted anomaly warning notifications, blocking the risk of data leakage from the source, comprehensively strengthening security, and ultimately greatly improving the accuracy, timeliness, and security of anomaly warnings of power metering devices.

[0025] 2. By deploying a lightweight student model locally on the power metering device, anomaly detection can be processed directly on the edge device, eliminating the need to upload all data to the server. This reduces network transmission time, and low-risk responses can be completed in milliseconds, significantly improving system response speed. In critical scenarios (such as electrical faults), this can prevent equipment damage and safety accidents, and solve the latency problem caused by existing methods that rely on server processing.

[0026] 3. By using knowledge distillation technology, large teacher models are compressed into student models, which reduce the computational resources (such as CPU and memory) required by the student models, making them easier to deploy on resource-constrained power metering devices. At the same time, the compressed models can still maintain high-precision detection (verified by the teacher models), reducing the hardware requirements of terminal devices, solving the bottleneck problem of deploying complex AI models on resource-constrained devices, and saving equipment costs.

[0027] 4. By employing multimodal feature extraction and multi-level feature fusion, it integrates multi-dimensional information such as electrical quantity data, operating status data, environmental data, and safety probe data, providing a more comprehensive anomaly identification capability. It avoids the limitations of a single data source. Combined with the teacher model to perform secondary verification of student detection results, it reduces the risk of false alarms and false negatives, improves detection accuracy, and is especially suitable for complex and ever-changing service environments.

[0028] 5. Data processing is encrypted throughout (e.g., first encrypted data packet, second encrypted data packet), combined with local rolling storage (only the latest data is retained) to prevent the leakage of sensitive data; at the same time, the federated learning mechanism is used for model updates, avoiding the transmission of raw data to the server, protecting the data privacy of different electricity metering devices, and solving the security risks of centralized data processing in traditional methods.

[0029] 6. The federated learning mechanism allows each node's model to be updated regularly, improving generalization ability based on local data without manual intervention; the hierarchical deployment of regional nodes and servers enables distributed management, making it easy to cover more electricity metering devices; the system can adapt to different environments and self-optimize model performance, solving the problems of poor scalability and model aging in existing early warning systems.

[0030] 7. Local processing reduces server computing and bandwidth consumption, lowering operating costs; automated response strategies reduce manual intervention and improve efficiency; in addition, rolling storage optimizes device storage space utilization, avoiding the high costs of big data storage, and overall saving energy and maintenance expenses.

[0031] 8. By constructing a multi-level early warning system, including local student model initial response, regional node teacher model verification, and server emergency response, a resilient protection layer is formed. For example, low-risk anomalies are handled locally, while high-risk anomalies are reported to the server for a strong response, enhancing the system's fault tolerance and ensuring continuous operation even when some nodes fail.

[0032] 9. By combining edge computing, knowledge distillation, and federated learning technologies, the system achieves high efficiency, accuracy, and security in anomaly early warning for electricity metering devices: Deploying lightweight student models at the edge for real-time anomaly detection significantly reduces response latency; using knowledge distillation to compress the model reduces the burden on terminal computing resources while ensuring detection accuracy; a dual verification mechanism of multimodal feature fusion and teacher models improves the robustness of anomaly identification in complex environments; encrypted data transmission and rolling storage design effectively protect privacy and security; and the distributed update mechanism of federated learning supports adaptive system expansion and continuous optimization of model performance, ultimately achieving a low-cost, highly reliable end-to-end early warning closed loop.

[0033] 10. The data preprocessing layer performs modal alignment and standardization on electrical quantity data, operational status data, environmental data, and safety probe data, outputting a four-modal tensor sequence with unified dimensions. This automatically aligns the modalities of data from different sources (such as time series data and graph structure data), reducing information loss due to dimensionality mismatch and enhancing the system's generalization ability in heterogeneous environments. Standardization processing (such as normalization) reduces external dependencies through built-in algorithms, improving processing efficiency and shortening training time. As a front-end module, this layer ensures the uniformity of input for subsequent feature extraction, providing a robust data foundation for the entire model.

[0034] 11. The multimodal feature extraction layer uses dedicated modules for different data types (temporal convolutional networks and bidirectional GRUs for electrical quantity data, graph convolutional networks for operational status data, fully connected residual networks for environmental data, and multi-head self-attention networks for safety probe data). Each module is optimized for the characteristics of the data type (e.g., temporal convolution captures the time dependence of electrical quantities, and graph convolution handles the topological relationships of operational status), improving feature discrimination and enhancing anomaly detection accuracy. By combining various deep learning techniques (e.g., RNN, GCN, Transformer), the limitations of a single model in processing multi-source data are overcome, improving overall performance. Each module is designed independently, allowing for easy replacement or upgrading according to application scenarios (e.g., adding a sensor data module), expanding the system's applicable scenarios.

[0035] 12. The multi-level feature fusion layer progressively aggregates features through primary fusion (modal attention mechanism), intermediate fusion (cross-modal interaction gate), and advanced fusion (temporal convolutional fusion block). The progressive fusion strategy (primary weighted aggregation, intermediate complementary enhancement, and advanced temporal pattern extraction) reduces intermodal redundancy, retains key complementary information (such as environmental data affecting operational status), and improves the discriminative power of the fused features. The cross-modal interaction gate and temporal convolutional fusion block effectively filter irrelevant data, reduce false alarm rate, and improve robustness in noisy environments. The temporal dimension is enhanced through temporal signal processing (using 1D convolution to extract cross-modal temporal patterns), optimizing response speed for real-time monitoring scenarios.

[0036] 13. The anomaly risk detection layer combines a Gaussian mixture variational autoencoder (GMVAE) for anomaly probability inference and a three-level fully connected layer for risk level prediction (outputting low, medium, and high risk probability distributions). GMVAE processes uncertain data (such as Gaussian mixture distributions), enhances the generalization ability to rare anomalies (such as transient faults in power systems), and effectively reduces the false negative rate. The risk level prediction module outputs probability distributions (rather than point estimates), providing objective decision-making basis (such as prioritizing high-risk items). This layer directly serves the output, ensuring that high-risk events are reported in a timely manner.

[0037] 14. The response strategy generation layer uses Conditional Generative Adversarial Network (CGAN) to generate response strategies based on advanced fusion features and risk probabilities. The CGAN-generated strategies are bound to contextual conditions (such as adjusting the response based on the risk level), automating the response process (such as suggesting maintenance actions), reducing manual intervention, and improving maintenance efficiency.

[0038] 15. The loss function integrates sub-losses from anomaly detection (binary cross-entropy), risk prediction (classification cross-entropy), and response generation (adversarial loss). Through hyperparameter weight balancing and multi-task joint optimization (adjustable hyperparameters α, β, γ), it avoids overfitting of a single task, ensuring efficient end-to-end convergence of the entire system and improving training stability and generalization ability. The unified loss function simplifies the parameter tuning process, reduces the number of iterations, and lowers computational resource consumption. Furthermore, the integration of multiple loss types (such as adversarial loss) into the loss function enhances the realism of the response strategy and the accuracy of detection.

[0039] 16. Deep fusion of multi-source heterogeneous data is achieved through modality alignment and standardization. Temporal convolutional networks, graph convolutional networks, residual networks, and multi-head self-attention mechanisms are specifically employed for feature extraction to maximize the preservation of modality-specific information. A multi-level progressive feature fusion mechanism (modal attention weighting, cross-modal interaction gate complementary enhancement, and temporal convolution extraction of cross-modal dynamic association) is innovatively constructed to significantly improve the collaborative expression ability between data. Furthermore, a Gaussian mixture variational autoencoder is combined to achieve high-precision anomaly probability inference. The risk level (low / medium / high risk) is quantified through a three-class fully connected layer, and a conditional generative adversarial network is used to generate dynamic response strategies, forming a closed-loop decision-making process of "detection-evaluation-decision". Its end-to-end jointly optimized multi-task loss function effectively coordinates the goals of anomaly identification, risk classification, and strategy generation, and finally outputs structured anomaly localization, risk quantification, and response schemes. While improving detection accuracy, it significantly reduces the need for manual intervention, and is especially suitable for real-time safety monitoring and intelligent operation and maintenance in complex industrial scenarios such as power systems.

[0040] 17. By comprehensively collecting multi-dimensional data from electricity metering devices (including electrical quantities, operating status, environmental and safety probe information), and combining the system's preprocessing workflow (handling missing values, outlier values, etc.) and intelligent labeling mechanism (abnormal items, risk levels, and response strategies), high-precision and comprehensive monitoring and analysis of the operating status of electricity metering devices is achieved. Its core advantages are: significantly improving the reliability and availability of data through standardized and automated data processing workflows; constructing high-quality datasets by integrating multi-dimensional dynamic data, enabling proactive identification of potential faults and safety risks, providing data-driven decision support for predictive maintenance, performance optimization, and safety protection of devices; and possessing high scalability, adapting to diverse power grid scenarios, significantly reducing equipment operation and maintenance costs, and improving the overall reliability of the power supply system.

[0041] 18. By optimizing dataset partitioning through stratified sampling, combined with dynamic hyperparameter adjustment and loss threshold control, high-precision model training is achieved. Multiple metrics (precision, recall, etc.) are used to rigorously verify model reliability, effectively improving the accuracy of anomaly detection. Furthermore, knowledge distillation technology is introduced to compress the teacher model into a student model adapted to terminal resource constraints, significantly reducing computational overhead while ensuring detection performance (verified by metrics such as F1-Score). Finally, a stratified deployment strategy (teacher model on regional node TEE, student model on power metering device TEE) is employed, utilizing a trusted execution environment to ensure data security and model tamper-proofing. Overall, this achieves high efficiency, lightweight design, and security in the device anomaly detection process, making it particularly suitable for resource-constrained scenarios such as smart grids with stringent real-time and privacy requirements.

[0042] 19. The accuracy of monitoring data is improved by using an adaptive wavelet denoising algorithm, and intelligent anomaly detection and risk classification are achieved by combining it with a student model, which significantly improves the reliability of the power metering device. Data security is ensured by dynamic key generation (SHA-256 hash based on timestamp and sequence number), multi-layer encryption (AES-128 and Base64 encoding), and obfuscation technology. At the same time, hardware security module storage and blockchain evidence storage are used to ensure data integrity and traceability. The risk classification response mechanism optimizes resource allocation, local processing of low-risk events reduces communication overhead, and real-time transmission of high-risk events through the TLS protocol ensures timeliness. Overall, it has the advantages of high data processing efficiency, strong security protection, optimized resource utilization, and flexible system expansion.

[0043] 20. By selecting standardized and computationally efficient cryptographic algorithms, security and overhead are balanced: Lightweight SHA-256 is used to generate dynamic keys and checksums (sacrificing some performance to ensure integrity), and AES-128 keys are dynamically generated using a combination of timestamps and device serial numbers (avoiding high-overhead key negotiation but exposing metadata and posing a risk). At the same time, low-computational-cost string obfuscation and Base64 encoding are designed (increasing data parsing complexity with simple operations with near-zero overhead). Under the premise of ensuring basic confidentiality and integrity, high-overhead public key encryption and strong authentication mechanisms (such as digital signatures) are intentionally avoided. Priority is given to adapting to resource-constrained environments such as electricity metering devices. In essence, dynamic keys and lightweight obfuscation are used to compensate for security weaknesses, and finally a basic security defense line is built with limited resources.

[0044] 21. By setting different encryption schemes for the first encrypted data packet, the second encrypted data packet, and the abnormal warning notification, security can be further improved.

[0045] 22. By receiving, decrypting, and verifying abnormal warning notifications in real time through the server, the risk level in the teacher's test results is accurately analyzed, and when a high risk is determined, a preset emergency script is automatically triggered, and a notification is pushed to the associated management terminal. This significantly shortens the response time for high-risk events, avoids the delay and misjudgment risk of manual intervention, and ensures the speed, accuracy, and consistency of emergency response through automated processes.

[0046] 23. By innovatively integrating edge computing, federated learning, homomorphic encryption, and knowledge distillation technologies, efficient distributed learning and training are achieved through each regional node using local real-time incremental data and anomaly feedback, while strictly protecting the data privacy of electricity metering devices (without sharing original data). Only the homomorphically encrypted model parameters are securely aggregated to update the global model, and then deployed to edge devices after being lightweighted by knowledge distillation technology. Ultimately, this significantly reduces network transmission load, ensures edge computing resources, and improves the timeliness of model updates, while effectively improving the global performance and local real-time anomaly detection accuracy of the electricity metering device monitoring model.

[0047] 24. By deploying a lightweight student model locally on the electricity metering device to achieve low-latency initial screening of anomalies, and combining it with the teacher model of regional nodes for high-precision verification, a collaborative early warning architecture of edge-node-cloud is formed, thereby significantly improving the real-time response. Multimodal feature fusion mechanisms (temporal convolution, graph convolution, attention network, etc.) are used to comprehensively analyze electrical quantities, operating status, environment and safety data, enhancing the accuracy of anomaly detection. A knowledge distillation compression model is adopted to adapt to terminal resource constraints, and dynamic key encryption, blockchain verification and federated learning mechanisms are used to ensure the security of data transmission, storage and updates. While reducing bandwidth consumption and operation and maintenance costs, efficient, accurate and autonomous closed-loop management of anomalies of electricity metering devices in complex environments is achieved. Attached Figure Description

[0048] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0049] Figure 1 This is a flowchart of an abnormal early warning method for an electricity metering device that combines edge computing according to the present invention. Detailed Implementation

[0050] The overall approach of the technical solution in this application is as follows: By deploying a lightweight student model on the power metering device to process multi-source monitoring data (electrical quantities, operating status, environment, and safety probes) in real time, and combining multimodal feature extraction and fusion technology to capture subtle abnormal signals, millisecond-level local anomaly initial judgment and response are achieved, significantly improving the timeliness of early warning; at the same time, the teacher model of the regional node performs secondary verification on the student detection results, and the influence of environmental interference and individual differences is eliminated through a dynamic deep learning model, significantly reducing false alarms and missed alarms and ensuring accuracy; in addition, a hierarchical data encryption, rolling storage, and federated learning update mechanism is adopted for local and regional nodes to ensure that the original monitoring data is processed only at the edge, and the server only receives encrypted anomaly early warning notifications, blocking the risk of data leakage from the source, comprehensively strengthening security, and thus improving the accuracy, timeliness, and security of anomaly early warning of the power metering device.

[0051] Please refer to Figure 1As shown, a preferred embodiment of the present invention, a method for early warning of anomalies in an energy metering device combining edge computing, includes the following steps: Step S1: Create a device anomaly detection model based on the data preprocessing layer, multimodal feature extraction layer, multi-level feature fusion layer, anomaly risk detection layer, response strategy generation layer, and output layer, and set the loss function of the device anomaly detection model. Step S2: Obtain a large amount of historical device monitoring data of electricity metering devices installed in different environments and with different service durations. The historical device monitoring data includes electrical quantity data, operating status data, environmental data, and safety probe data. After preprocessing and labeling each of the historical device monitoring data, a dataset is constructed. Step S3: Train the device anomaly detection model using the dataset and loss function. During training, compress the device anomaly detection model using knowledge distillation technology to construct a teacher model and a student model. Deploy the teacher model to a regional node and the student model to an energy metering device connected to the regional node. The regional node is an edge computing device that replicates and manages energy metering devices within a region and has higher performance than the energy metering devices. Step S4: The power metering device collects real-time device monitoring data, preprocesses the real-time device monitoring data and inputs it into the deployed student model to obtain student detection results carrying student anomalies, student risk levels and student response strategies. The student detection results and the corresponding real-time monitoring data are encrypted into a first encrypted data packet. The first encrypted data packet is locally rolled storage. An anomaly response is executed based on the student detection results, or the first encrypted data packet is sent to the regional node. Step S5: The regional node decrypts the received first encrypted data packet to obtain student detection results and real-time monitoring data. Based on the student detection results, the real-time monitoring data is input into the deployed teacher model to obtain teacher detection results carrying teacher anomalies, teacher risk levels, and teacher response strategies. The teacher detection results and the corresponding real-time monitoring data are encrypted into a second encrypted data packet. The second encrypted data packet is locally rolled and stored. An anomaly response is executed based on the teacher detection results, or the teacher detection results are encrypted into an anomaly warning notification and sent to the server in real time. Step S6: The server decrypts the received anomaly warning notification to obtain the teacher detection result, and executes an emergency response based on the teacher detection result; Step S7: Update the teacher and student models using the federated learning mechanism.

[0052] In step S1, the data preprocessing layer is used to perform modal alignment and standardization on the input electrical quantity data, operating status data, environmental data and safety probe data, and output a four-modal tensor sequence with unified dimensions. Electrical quantity data (time series) is segmented by sliding window and normalized by Z-score; operating status data (discrete signals) is converted into one-hot encoded vectors; continuous variables in environmental data (hybrid type) are normalized and discrete variables are embedded in the encoding; semantic vectors are extracted from safety probe data (text logs) using a BERT pre-trained model. The multimodal feature extraction layer is constructed based on an electrical quantity feature extraction module, an operational state feature extraction module, an environmental feature extraction module, and a safety probe feature extraction module. The electrical quantity feature extraction module extracts electrical quantity features from the four-modal tensor sequence using a temporal convolutional network (TCN) and a bidirectional GRU. The TCN captures long-range dependencies through dilated convolutions, and the bidirectional GRU extracts temporal dynamic features. The operational state feature extraction module extracts operational state features from the four-modal tensor sequence using a graph convolutional network (GCN), i.e., constructing a state transition graph (nodes = state types, edges = transition probabilities) and extracting topological features. The environmental feature extraction module extracts environmental features from the four-modal tensor sequence using a fully connected residual network, i.e., learning nonlinear environmental influencing factors using three layers of residual blocks. The safety probe feature extraction module extracts safety probe features from the four-modal tensor sequence using a multi-head self-attention network, i.e., focusing on semantic associations between abnormal keywords. The multi-level feature fusion layer is constructed based on a primary fusion module, an intermediate fusion module, and a high-level fusion module. The primary fusion module is used to perform weighted aggregation of electrical quantity features, operating status features, environmental features, and safety probe features through a modal attention mechanism to obtain initial fused features. The intermediate fusion module is used to enhance the initial fused features with complementary information through a cross-modal interaction gate to obtain intermediate fused features. The high-level fusion module is used to treat the intermediate fused features as a time-series signal through a temporal convolutional fusion block, and extract cross-modal temporal patterns from the time-series signal using 1D convolution to obtain high-level fused features. The primary fusion module is used to address the problem of unbalanced modal contributions; the intermediate fusion module is used to capture nonlinear interactions between modes (such as the combined effect of "voltage drop + temperature change"); the advanced fusion module is used to learn the temporal evolution law of multimodal features; the information transmission path is: original modal features → modal importance screening → cross-modal interaction enhancement → spatiotemporal feature refinement; The anomaly risk detection layer is constructed based on an anomaly detection module and a risk level prediction module. The anomaly detection module is used to infer the anomaly probability of different anomalies by using a Gaussian mixture variational autoencoder (GM-VAE, where the encoder learns the latent space distribution and the decoder calculates the reconstruction error). The risk level prediction module is used to infer the risk level probability distribution (low / medium / high) of different anomalies by using a three-layer cascaded fully connected layer on the high-level fusion features. The response strategy generation layer is used to reason about the advanced fusion features and risk level probability distribution through a conditional generative adversarial network to obtain the response strategy for anomalies. The generator of the conditional generative adversarial network takes high-level fusion features and risk level probability distribution as conditional inputs, generates a response policy through an LSTM decoder, and the discriminator uses a convolutional text classifier to determine whether the generated response policy conforms to the historical template. The output layer is used to output detection results carrying anomaly items, risk levels, and response strategies based on anomaly probability, risk level probability distribution, and response strategies; the risk level is low risk, medium risk, or high risk. The formula for the loss function is: ; in, This represents the loss value of the loss function; The anomaly detection sub-loss is represented by a binary cross-entropy loss function, which is used to supervise the output of the anomaly detection module and ensure that the predicted anomaly probability is consistent with the true anomaly label. The risk level prediction sub-loss is represented by the classification cross-entropy loss function, which is used to supervise the output of the risk level prediction module to ensure that the predicted risk level probability distribution is consistent with the true risk level label. The response policy generation sub-loss is represented by the standard adversarial loss function of conditional generative adversarial networks (including the adversarial part and potential content constraints), which is used to supervise the output of the response policy generation layer to ensure that the generated response policy is consistent with the real policy. All of these represent hyperparameters used to balance the contributions of each sub-loss, and can be tuned through cross-validation. .

[0053] Gaussian mixture variational autoencoders (GMVAEs) are commonly used for anomaly probability inference, but the output of the anomaly detection module is directly the anomaly probability (rather than the latent distribution). Therefore, the binary cross-entropy loss function is an efficient and direct form of supervision, eliminating the need for explicit variational lower bound (ELBO) loss. The internal variational losses of GMVAEs (such as KL divergence) can be implicitly handled through automatic differentiation tools. The three-layer cascaded fully connected layer of the risk level prediction module outputs a softmax-normalized risk level probability distribution. The classification cross-entropy loss function is the standard choice and is suitable for multi-classification tasks. Conditional generative adversarial networks (CGANs) are guided by conditional information (high-level fusion features and risk level probability distributions). Adversarial loss promotes the rationality and diversity of strategies; content loss provides direct supervision (assuming real strategies are available), mitigating the pattern collapse problem.

[0054] Step S2 specifically involves: Acquire a large amount of historical monitoring data from electricity metering devices installed in different environments and with varying service durations; The historical device monitoring data includes electrical quantity data, operating status data, environmental data, and safety probe data; the electrical quantity data includes at least basic AC electrical quantities and power quality parameters; the operating status data includes at least hardware self-test status, software operating status, and resource usage data; the environmental data includes at least temperature, humidity, air pressure, vibration, light intensity, location information, and external magnetic field strength; and the safety probe data includes at least firmware integrity verification values ​​and safety event logs. The basic AC electrical quantities include voltage, current, power, and electrical energy; voltage includes instantaneous values, effective values ​​(RMS), and average values ​​of three-phase voltages (Va, Vb, Vc), line voltages (Vab, Vbc, Vca), zero-sequence voltage (V0), and neutral point voltage; current includes instantaneous values, effective values ​​(RMS), and average values ​​of three-phase currents (Ia, Ib, Ic), zero-sequence current (I0), and neutral point current; power includes active power (P - each phase, total), reactive power (Q - each phase, total), apparent power (S - each phase, total), and power factor (PF - each phase, total); the power quality parameters include voltage / current harmonics (each harmonic (e.g., 2nd-50th)). The self-test status includes the following parameters: total load (THD), amplitude, phase angle; voltage imbalance, current imbalance, voltage deviation, frequency deviation, voltage swell, voltage drop, amplitude and duration of short interruptions, voltage fluctuation, and flicker. The hardware self-test status includes core component status, power supply status, storage status, external interface status, display status, and button / operation status. Core component status includes the self-test status (Pass / Fail, ErrorCode) of key chips such as the metering chip, main control MCU / CPU, storage chip, clock chip, and communication module. Power supply status includes battery voltage / remaining capacity, power input voltage, DC-DC converter status, and power supply anomalies (such as power failure or surge). Storage status includes internal memory (RAM, Flash, EEPROM). The system includes: usage rate, erase / write cycles, bad block information, and read / write error counts; external interface status including connection status, communication rate, and error frame count for ports such as RS-485, infrared, carrier, low-power wireless, and Ethernet; display status including LCD / LED display screen operating status and backlight status; button / operation status including local button operation records and status; software running status including operating system / firmware status, application status, file system status, and task scheduling information; resource usage data including CPU load rate, core temperature, memory usage (RAM, Swap), storage space usage and remaining space, communication interface bandwidth usage, and data throughput; and security event logs including detailed records of all detected security events (such as tampering alarms, authentication failures, integrity verification failures, and abnormal behavior), including timestamps, event types, severity levels, and related components.

[0055] The monitoring data of each historical device is preprocessed, including at least missing value handling, outlier handling, data alignment and time synchronization, data transformation and standardization. The preprocessed monitoring data of each historical device is labeled, including at least anomalies, risk levels and response strategies. A dataset is constructed based on the labeled monitoring data of each historical device.

[0056] Missing value handling involves identifying missing values ​​in data records and employing one or more of the following strategies based on the characteristics and context of the missing data: a) deleting entire records containing missing key features or with excessively high missing values; b) filling missing values ​​for continuous features (such as temperature and voltage) using statistical methods (such as mean, median, and interpolation between previous and next time points); c) filling missing values ​​for categorical features (such as specific hardware status codes) using the mode or labeling them as "unknown"; d) filling missing values ​​for time series data using time series interpolation methods (such as linear interpolation and spline interpolation).

[0057] Outlier handling involves identifying and processing values ​​that significantly deviate from the normal range (outliers). Methods include: a) identifying outliers based on statistical methods (such as standard deviation method and box plot method); b) judging the rationality of outliers by combining domain knowledge (such as equipment technical specifications and operating limits); c) deleting, correcting (such as replacing with upper and lower limits) or marking outliers that are confirmed to be erroneous or invalid; d) retaining but marking outliers that may reflect real faults or special events.

[0058] Data alignment and time synchronization ensure that different types of data (electrical quantities, status, environment, safety) from the same energy metering device are aligned on the timestamp. It addresses the inconsistency of timestamps caused by different sampling frequencies of different sensors or data sources by resampling (upsampling / downsampling) or time window aggregation (such as calculating the average, maximum, and minimum values ​​per second / minute) to unify the data to the same time base.

[0059] Data conversion and standardization involve converting data into a format suitable for model processing (such as converting text-based status codes into numerical codes or one-hot codes), and standardizing or normalizing continuous numerical features with different dimensions and orders of magnitude (such as voltage values, temperature values, and memory usage values).

[0060] Step S3 specifically involves: Using stratified sampling, the dataset is divided into a training set, a validation set, and a test set based on a preset ratio. The device anomaly detection model is trained using the training set. During training, the device anomaly detection model is continuously optimized, including at least the learning rate, batch size, number of training rounds, number of hidden layers, number of neurons per layer, regularization parameters, and hyperparameters of the learning rate scheduling strategy, until the loss value of the loss function is less than a preset loss threshold, or a preset early stopping mechanism is met, such as terminating training when there is no improvement in performance for N consecutive rounds. Precision, recall, F1-Score, AUROC, and prediction accuracy are calculated using the validation set to validate the trained device anomaly detection model. If the validation fails, the training set is expanded and training continues; if the validation passes, then: The confidence level and inference latency are calculated using the test set to test the validated device anomaly detection model. If the test fails, the training set is expanded for further training; if the test passes, then: The device anomaly detection model is used as the teacher model. A lightweight model architecture is selected as the student model based on the computational resource constraints of the electricity metering device. The model parameters of the student model are randomly initialized. Knowledge distillation technology is used to train the student model using the output of the teacher model as soft labels, allowing the student model to inherit the key knowledge of the teacher model. The trained student model undergoes performance verification, including at least precision, recall, F1-Score, AUROC, and prediction accuracy, to complete the compression of the device anomaly detection model. The performance of the student model is no less than 95% of that of the teacher model. The teacher model is deployed to the TEE environment of the regional node, and the student model is deployed to the TEE environment of the power metering device connected to the regional node.

[0061] Step S4 specifically involves: The electricity metering device collects real-time device monitoring data, including electrical quantity data, operating status data, environmental data, and safety probe data. The real-time device monitoring data is preprocessed by an adaptive wavelet denoising algorithm to filter out noise. The preprocessed real-time device monitoring data is then input into a deployed student model to obtain student detection results carrying student anomalies, student risk levels, and student response strategies. The electricity metering device obtains the current first timestamp and the first device serial number of the device, concatenates the first timestamp and the first device serial number into a first time series string, calculates the first hash value of the first time series string using the SHA-256 algorithm, and extracts the first 128 bits from the first hash value as a first dynamic key; concatenates the student detection results and real-time monitoring data into a first combined data block, calculates the second hash value of the first combined data block using the SHA-256 algorithm, and encrypts the first combined data block and the second hash value using the first dynamic key using the AES-128 algorithm to obtain first encrypted data; concatenates the first encrypted data, the first timestamp, and the first device serial number to obtain first concatenated data; extracts a first preset length of characters from the first timestamp based on a preset first truncation rule as a first obfuscation string, inserts the first obfuscation string into the first specified position of the first concatenated data to obtain first obfuscated data, and performs Base64 encoding on the first obfuscated data to obtain a first encrypted data packet; The electricity metering device continuously stores the first encrypted data packet to the local first hardware security module, calculates the first data fingerprint of the first encrypted data packet using the CRC32 algorithm, and uploads the first data fingerprint to the blockchain; The electricity metering device analyzes the student detection results. When the student risk level carried by the student detection results is low risk, it executes an abnormal response based on the student response strategy carried by the student detection results. Otherwise, it sends the first encrypted data packet to the regional node in real time via the TLS protocol.

[0062] Step S5 specifically involves: The regional node receives the first encrypted data packet in real time. After obtaining the first data fingerprint from the blockchain and performing an integrity check on the first encrypted data packet, it decodes the first encrypted data packet using Base64 to obtain the first obfuscated data. Based on the first specified position and the first preset length, it locates the first obfuscated string. It removes the first obfuscated string from the first obfuscated data to obtain the first concatenated data. It parses the first concatenated data to obtain the first encrypted data, the first timestamp, and the first device serial number. It performs timeliness verification using the first timestamp and then legality verification using the first device serial number. It then concatenates the first timestamp and the first device serial number to form a first time sequence string. It calculates the first hash value of the first time sequence string using the SHA-256 algorithm. It extracts the first 128 bits from the first hash value as the first dynamic key. It calls the first dynamic key using the AES-128 algorithm to decrypt the first encrypted data to obtain the first combined data block and the second hash value. After performing a second integrity check on the first combined data block using the second hash value, it parses the first combined data block to obtain the student detection results and real-time monitoring data. The regional node parses the student detection results. When the student risk level carried by the student detection results is medium risk or high risk, the real-time monitoring data is input into the deployed teacher model to obtain the teacher detection results carrying teacher anomalies, teacher risk levels, and teacher response strategies. The teacher detection results and the corresponding real-time monitoring data are encrypted into a second encrypted data packet. The second encrypted data packet is continuously stored in the local second hardware security module. The second data fingerprint of the second encrypted data packet is calculated using the CRC32 algorithm and uploaded to the blockchain. The regional node parses the teacher detection results. When the teacher risk level carried by the teacher detection results is low or medium risk, it controls the corresponding electricity metering device to perform an abnormal response based on the teacher response strategy carried by the teacher detection results. When the teacher risk level carried by the teacher detection results is high risk, it encrypts the teacher detection results into an abnormal warning notification and sends the abnormal warning notification to the server in real time via the TLS protocol.

[0063] In step S5, encrypting the teacher's detection results and the corresponding real-time monitoring data into a second encrypted data packet specifically involves: The regional node obtains the current second timestamp and the second device serial number of the local machine, concatenates the second timestamp and the second device serial number into a second time series string, calculates the third hash value of the second time series string using the SHA-512 algorithm, and extracts the last 256 bits from the third hash value as the second dynamic key; concatenates the teacher detection results and real-time monitoring data into a second combined data block, calculates the fourth hash value of the second combined data block using the SHA-512 algorithm, and encrypts the second combined data block and the fourth hash value using the second dynamic key using the AES-256 algorithm to obtain second encrypted data; concatenates the second encrypted data, the second timestamp, and the second device serial number to obtain second concatenated data; based on a preset second truncation rule, extracts a second preset length of characters from the second timestamp as a second obfuscation string, inserts the second obfuscation string into the second specified position of the second concatenated data to obtain second obfuscated data, and performs Base64 encoding on the second obfuscated data to obtain a second encrypted data packet.

[0064] In step S5, encrypting the teacher's detection result into an anomaly warning notification specifically involves: The regional node obtains the current third timestamp and the local device serial number, concatenates the third timestamp and the second device serial number to form a third time series string, calculates the fifth hash value of the third time series string using the SHA-512 algorithm, and extracts bits 4-259 from the fifth hash value as the third dynamic key; it then calculates the sixth hash value of the teacher detection result using the SHA-512 algorithm, and uses S... M4 The algorithm calls the third dynamic key to encrypt the teacher detection result and the sixth hash value to obtain the third encrypted data. The third encrypted data, the third timestamp, and the second device serial number are concatenated to obtain the third concatenated data. Based on the preset third truncation rule, the third preset length characters are truncated from the third timestamp as the third obfuscation string. The third obfuscation string is inserted into the third specified position of the third concatenated data to obtain the third obfuscated data. The third obfuscated data is Base64 encoded to obtain the abnormal warning notification.

[0065] Step S6 specifically involves: The server receives the abnormal warning notification in real time, decrypts and verifies the abnormal warning notification to obtain the teacher detection result, parses the teacher detection result, and when the teacher risk level carried by the teacher detection result is high risk, it automatically triggers the preset emergency response mechanism based on the preset script to execute the emergency response and pushes the emergency response notification to the pre-associated management terminal.

[0066] Step S7 specifically involves: Each regional node constructs an incremental dataset based on real-time device monitoring data from different electricity metering devices. The incremental dataset is labeled based on received abnormal response feedback. When the data volume of the incremental dataset reaches a preset threshold, the teacher model is trained and its performance is verified using the incremental dataset. The updated parameters of the teacher model are extracted, and the updated parameters are encrypted into encrypted parameters using a homomorphic encryption algorithm. The encrypted parameters are then uploaded to the server via the TLS protocol. The server aggregates the encrypted parameters uploaded by each regional node to obtain global model parameters, and then sends the global model parameters to each regional node via the TLS protocol. Each regional node updates the teacher model based on the global model parameters, and updates the student model of the corresponding power metering device after knowledge distillation of the global model parameters. In summary, the advantages of this invention are as follows: 1. A device anomaly detection model is created through a data preprocessing layer, a multimodal feature extraction layer, a multi-level feature fusion layer, an anomaly risk detection layer, a response strategy generation layer, and an output layer. A loss function for the device anomaly detection model is set. Then, a large amount of historical device monitoring data is acquired to construct a dataset. The device anomaly detection model is trained using the dataset and the loss function. During training, the device anomaly detection model is compressed using knowledge distillation technology to construct a teacher model and a student model. The teacher model is deployed to regional nodes, and the student model is deployed to energy metering devices connected to the regional nodes. The energy metering devices collect real-time device monitoring data, preprocess it, and input it into the student model to obtain student detection results carrying student anomaly items, student risk levels, and student response strategies. The student detection results and corresponding real-time monitoring data are encrypted into a first encrypted data packet, which is locally stored. Anomaly responses are executed based on the student detection results, or the first encrypted data packet is sent to the regional node. The regional node decrypts the first encrypted data packet to obtain the student detection results and real-time monitoring data. Based on the student detection results, the real-time monitoring data is input into the teacher model to obtain teacher detection results carrying teacher anomaly items, teacher risk levels, and teacher response strategies. The results and corresponding real-time monitoring data are encrypted into a second encrypted data packet. This second encrypted data packet is locally stored on a rolling basis. An anomaly response is executed based on the teacher's detection results, or the teacher's detection results are encrypted into an anomaly warning notification and sent to the server in real time. The server decrypts the anomaly warning notification to obtain the teacher's detection results, executes an emergency response based on the teacher's detection results, and updates each teacher model and student model through a federated learning mechanism. That is, by deploying a lightweight student model, the power metering device processes multi-source monitoring data (electrical quantities, operating status, environment, and safety probes) in real time. Combined with multimodal feature extraction and fusion technology, it captures subtle anomaly signals, achieving millisecond-level local anomaly initial judgment and response, greatly improving the timeliness of warnings. At the same time, the teacher model of the regional node performs secondary verification of the student's detection results. The dynamic deep learning model eliminates the influence of environmental interference and individual differences, significantly reducing false alarms and missed alarms, and ensuring accuracy. In addition, the use of local and regional node hierarchical data encryption, rolling storage, and federated learning update mechanisms ensures that the original monitoring data is processed only at the edge, and the server only receives encrypted anomaly warning notifications, blocking the risk of data leakage from the source, comprehensively strengthening security, and ultimately greatly improving the accuracy, timeliness, and security of anomaly warnings of power metering devices.

[0067] 2. By deploying a lightweight student model locally on the power metering device, anomaly detection can be processed directly on the edge device, eliminating the need to upload all data to the server. This reduces network transmission time, and low-risk responses can be completed in milliseconds, significantly improving system response speed. In critical scenarios (such as electrical faults), this can prevent equipment damage and safety accidents, and solve the latency problem caused by existing methods that rely on server processing.

[0068] 3. By using knowledge distillation technology, large teacher models are compressed into student models, which reduce the computational resources (such as CPU and memory) required by the student models, making them easier to deploy on resource-constrained power metering devices. At the same time, the compressed models can still maintain high-precision detection (verified by the teacher models), reducing the hardware requirements of terminal devices, solving the bottleneck problem of deploying complex AI models on resource-constrained devices, and saving equipment costs.

[0069] 4. By employing multimodal feature extraction and multi-level feature fusion, it integrates multi-dimensional information such as electrical quantity data, operating status data, environmental data, and safety probe data, providing a more comprehensive anomaly identification capability. It avoids the limitations of a single data source. Combined with the teacher model to perform secondary verification of student detection results, it reduces the risk of false alarms and false negatives, improves detection accuracy, and is especially suitable for complex and ever-changing service environments.

[0070] 5. Data processing is encrypted throughout (e.g., first encrypted data packet, second encrypted data packet), combined with local rolling storage (only the latest data is retained) to prevent the leakage of sensitive data; at the same time, the federated learning mechanism is used for model updates, avoiding the transmission of raw data to the server, protecting the data privacy of different electricity metering devices, and solving the security risks of centralized data processing in traditional methods.

[0071] 6. The federated learning mechanism allows each node's model to be updated regularly, improving generalization ability based on local data without manual intervention; the hierarchical deployment of regional nodes and servers enables distributed management, making it easy to cover more electricity metering devices; the system can adapt to different environments and self-optimize model performance, solving the problems of poor scalability and model aging in existing early warning systems.

[0072] 7. Local processing reduces server computing and bandwidth consumption, lowering operating costs; automated response strategies reduce manual intervention and improve efficiency; in addition, rolling storage optimizes device storage space utilization, avoiding the high costs of big data storage, and overall saving energy and maintenance expenses.

[0073] 8. By constructing a multi-level early warning system, including local student model initial response, regional node teacher model verification, and server emergency response, a resilient protection layer is formed. For example, low-risk anomalies are handled locally, while high-risk anomalies are reported to the server for a strong response, enhancing the system's fault tolerance and ensuring continuous operation even when some nodes fail.

[0074] 9. By combining edge computing, knowledge distillation, and federated learning technologies, the system achieves high efficiency, accuracy, and security in anomaly early warning for electricity metering devices: Deploying lightweight student models at the edge for real-time anomaly detection significantly reduces response latency; using knowledge distillation to compress the model reduces the burden on terminal computing resources while ensuring detection accuracy; a dual verification mechanism of multimodal feature fusion and teacher models improves the robustness of anomaly identification in complex environments; encrypted data transmission and rolling storage design effectively protect privacy and security; and the distributed update mechanism of federated learning supports adaptive system expansion and continuous optimization of model performance, ultimately achieving a low-cost, highly reliable end-to-end early warning closed loop.

[0075] 10. The data preprocessing layer performs modal alignment and standardization on electrical quantity data, operational status data, environmental data, and safety probe data, outputting a four-modal tensor sequence with unified dimensions. This automatically aligns the modalities of data from different sources (such as time series data and graph structure data), reducing information loss due to dimensionality mismatch and enhancing the system's generalization ability in heterogeneous environments. Standardization processing (such as normalization) reduces external dependencies through built-in algorithms, improving processing efficiency and shortening training time. As a front-end module, this layer ensures the uniformity of input for subsequent feature extraction, providing a robust data foundation for the entire model.

[0076] 11. The multimodal feature extraction layer uses dedicated modules for different data types (temporal convolutional networks and bidirectional GRUs for electrical quantity data, graph convolutional networks for operational status data, fully connected residual networks for environmental data, and multi-head self-attention networks for safety probe data). Each module is optimized for the characteristics of the data type (e.g., temporal convolution captures the time dependence of electrical quantities, and graph convolution handles the topological relationships of operational status), improving feature discrimination and enhancing anomaly detection accuracy. By combining various deep learning techniques (e.g., RNN, GCN, Transformer), the limitations of a single model in processing multi-source data are overcome, improving overall performance. Each module is designed independently, allowing for easy replacement or upgrading according to application scenarios (e.g., adding a sensor data module), expanding the system's applicable scenarios.

[0077] 12. The multi-level feature fusion layer progressively aggregates features through primary fusion (modal attention mechanism), intermediate fusion (cross-modal interaction gate), and advanced fusion (temporal convolutional fusion block). The progressive fusion strategy (primary weighted aggregation, intermediate complementary enhancement, and advanced temporal pattern extraction) reduces intermodal redundancy, retains key complementary information (such as environmental data affecting operational status), and improves the discriminative power of the fused features. The cross-modal interaction gate and temporal convolutional fusion block effectively filter irrelevant data, reduce false alarm rate, and improve robustness in noisy environments. The temporal dimension is enhanced through temporal signal processing (using 1D convolution to extract cross-modal temporal patterns), optimizing response speed for real-time monitoring scenarios.

[0078] 13. The anomaly risk detection layer combines a Gaussian mixture variational autoencoder (GMVAE) for anomaly probability inference and a three-level fully connected layer for risk level prediction (outputting low, medium, and high risk probability distributions). GMVAE processes uncertain data (such as Gaussian mixture distributions), enhances the generalization ability to rare anomalies (such as transient faults in power systems), and effectively reduces the false negative rate. The risk level prediction module outputs probability distributions (rather than point estimates), providing objective decision-making basis (such as prioritizing high-risk items). This layer directly serves the output, ensuring that high-risk events are reported in a timely manner.

[0079] 14. The response strategy generation layer uses Conditional Generative Adversarial Network (CGAN) to generate response strategies based on advanced fusion features and risk probabilities. The CGAN-generated strategies are bound to contextual conditions (such as adjusting the response based on the risk level), automating the response process (such as suggesting maintenance actions), reducing manual intervention, and improving maintenance efficiency.

[0080] 15. The loss function integrates sub-losses from anomaly detection (binary cross-entropy), risk prediction (classification cross-entropy), and response generation (adversarial loss). Through hyperparameter weight balancing and multi-task joint optimization (adjustable hyperparameters α, β, γ), it avoids overfitting of a single task, ensuring efficient end-to-end convergence of the entire system and improving training stability and generalization ability. The unified loss function simplifies the parameter tuning process, reduces the number of iterations, and lowers computational resource consumption. Furthermore, the integration of multiple loss types (such as adversarial loss) into the loss function enhances the realism of the response strategy and the accuracy of detection.

[0081] 16. Deep fusion of multi-source heterogeneous data is achieved through modality alignment and standardization. Temporal convolutional networks, graph convolutional networks, residual networks, and multi-head self-attention mechanisms are specifically employed for feature extraction to maximize the preservation of modality-specific information. A multi-level progressive feature fusion mechanism (modal attention weighting, cross-modal interaction gate complementary enhancement, and temporal convolution extraction of cross-modal dynamic association) is innovatively constructed to significantly improve the collaborative expression ability between data. Furthermore, a Gaussian mixture variational autoencoder is combined to achieve high-precision anomaly probability inference. The risk level (low / medium / high risk) is quantified through a three-class fully connected layer, and a conditional generative adversarial network is used to generate dynamic response strategies, forming a closed-loop decision-making process of "detection-evaluation-decision". Its end-to-end jointly optimized multi-task loss function effectively coordinates the goals of anomaly identification, risk classification, and strategy generation, and finally outputs structured anomaly localization, risk quantification, and response schemes. While improving detection accuracy, it significantly reduces the need for manual intervention, and is especially suitable for real-time safety monitoring and intelligent operation and maintenance in complex industrial scenarios such as power systems.

[0082] 17. By comprehensively collecting multi-dimensional data from electricity metering devices (including electrical quantities, operating status, environmental and safety probe information), and combining the system's preprocessing workflow (handling missing values, outlier values, etc.) and intelligent labeling mechanism (abnormal items, risk levels, and response strategies), high-precision and comprehensive monitoring and analysis of the operating status of electricity metering devices is achieved. Its core advantages are: significantly improving the reliability and availability of data through standardized and automated data processing workflows; constructing high-quality datasets by integrating multi-dimensional dynamic data, enabling proactive identification of potential faults and safety risks, providing data-driven decision support for predictive maintenance, performance optimization, and safety protection of devices; and possessing high scalability, adapting to diverse power grid scenarios, significantly reducing equipment operation and maintenance costs, and improving the overall reliability of the power supply system.

[0083] 18. By optimizing dataset partitioning through stratified sampling, combined with dynamic hyperparameter adjustment and loss threshold control, high-precision model training is achieved. Multiple metrics (precision, recall, etc.) are used to rigorously verify model reliability, effectively improving the accuracy of anomaly detection. Furthermore, knowledge distillation technology is introduced to compress the teacher model into a student model adapted to terminal resource constraints, significantly reducing computational overhead while ensuring detection performance (verified by metrics such as F1-Score). Finally, a stratified deployment strategy (teacher model on regional node TEE, student model on power metering device TEE) is employed, utilizing a trusted execution environment to ensure data security and model tamper-proofing. Overall, this achieves high efficiency, lightweight design, and security in the device anomaly detection process, making it particularly suitable for resource-constrained scenarios such as smart grids with stringent real-time and privacy requirements.

[0084] 19. The accuracy of monitoring data is improved by using an adaptive wavelet denoising algorithm, and intelligent anomaly detection and risk classification are achieved by combining it with a student model, which significantly improves the reliability of the power metering device. Data security is ensured by dynamic key generation (SHA-256 hash based on timestamp and sequence number), multi-layer encryption (AES-128 and Base64 encoding), and obfuscation technology. At the same time, hardware security module storage and blockchain evidence storage are used to ensure data integrity and traceability. The risk classification response mechanism optimizes resource allocation, local processing of low-risk events reduces communication overhead, and real-time transmission of high-risk events through the TLS protocol ensures timeliness. Overall, it has the advantages of high data processing efficiency, strong security protection, optimized resource utilization, and flexible system expansion.

[0085] 20. By selecting standardized and computationally efficient cryptographic algorithms, security and overhead are balanced: Lightweight SHA-256 is used to generate dynamic keys and checksums (sacrificing some performance to ensure integrity), and AES-128 keys are dynamically generated using a combination of timestamps and device serial numbers (avoiding high-overhead key negotiation but exposing metadata and posing a risk). At the same time, low-computational-cost string obfuscation and Base64 encoding are designed (increasing data parsing complexity with simple operations with near-zero overhead). Under the premise of ensuring basic confidentiality and integrity, high-overhead public key encryption and strong authentication mechanisms (such as digital signatures) are intentionally avoided. Priority is given to adapting to resource-constrained environments such as electricity metering devices. In essence, dynamic keys and lightweight obfuscation are used to compensate for security weaknesses, and finally a basic security defense line is built with limited resources.

[0086] 21. By setting different encryption schemes for the first encrypted data packet, the second encrypted data packet, and the abnormal warning notification, security can be further improved.

[0087] 22. By receiving, decrypting, and verifying abnormal warning notifications in real time through the server, the risk level in the teacher's test results is accurately analyzed, and when a high risk is determined, a preset emergency script is automatically triggered, and a notification is pushed to the associated management terminal. This significantly shortens the response time for high-risk events, avoids the delay and misjudgment risk of manual intervention, and ensures the speed, accuracy, and consistency of emergency response through automated processes.

[0088] 23. By innovatively integrating edge computing, federated learning, homomorphic encryption, and knowledge distillation technologies, efficient distributed learning and training are achieved through each regional node using local real-time incremental data and anomaly feedback, while strictly protecting the data privacy of electricity metering devices (without sharing original data). Only the homomorphically encrypted model parameters are securely aggregated to update the global model, and then deployed to edge devices after being lightweighted by knowledge distillation technology. Ultimately, this significantly reduces network transmission load, ensures edge computing resources, and improves the timeliness of model updates, while effectively improving the global performance and local real-time anomaly detection accuracy of the electricity metering device monitoring model.

[0089] 24. By deploying a lightweight student model locally on the electricity metering device to achieve low-latency initial screening of anomalies, and combining it with the teacher model of regional nodes for high-precision verification, a collaborative early warning architecture of edge-node-cloud is formed, thereby significantly improving the real-time response. Multimodal feature fusion mechanisms (temporal convolution, graph convolution, attention network, etc.) are used to comprehensively analyze electrical quantities, operating status, environment and safety data, enhancing the accuracy of anomaly detection. A knowledge distillation compression model is adopted to adapt to terminal resource constraints, and dynamic key encryption, blockchain verification and federated learning mechanisms are used to ensure the security of data transmission, storage and updates. While reducing bandwidth consumption and operation and maintenance costs, efficient, accurate and autonomous closed-loop management of anomalies of electricity metering devices in complex environments is achieved.

[0090] While specific embodiments of the present invention have been described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and not intended to limit the scope of the present invention. Equivalent modifications and variations made by those skilled in the art in accordance with the spirit of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for early warning of anomalies in an electricity metering device combining edge computing, characterized in that: Includes the following steps: Step S1: Create a device anomaly detection model based on the data preprocessing layer, multimodal feature extraction layer, multi-level feature fusion layer, anomaly risk detection layer, response strategy generation layer, and output layer, and set the loss function of the device anomaly detection model. Step S2: Obtain a large amount of historical device monitoring data of electricity metering devices installed in different environments and with different service durations. The historical device monitoring data includes electrical quantity data, operating status data, environmental data, and safety probe data. After preprocessing and labeling each of the historical device monitoring data, a dataset is constructed. Step S3: Train the device anomaly detection model using the dataset and loss function. During the training process, compress the device anomaly detection model using knowledge distillation technology to construct a teacher model and a student model. Deploy the teacher model to the regional node and the student model to the power metering device connected to the regional node. Step S4: The power metering device collects real-time device monitoring data, preprocesses the real-time device monitoring data and inputs it into the deployed student model to obtain student detection results carrying student anomalies, student risk levels and student response strategies. The student detection results and the corresponding real-time monitoring data are encrypted into a first encrypted data packet. The first encrypted data packet is locally rolled storage. An anomaly response is executed based on the student detection results, or the first encrypted data packet is sent to the regional node. Step S5: The regional node decrypts the received first encrypted data packet to obtain student detection results and real-time monitoring data. Based on the student detection results, the real-time monitoring data is input into the deployed teacher model to obtain teacher detection results carrying teacher anomalies, teacher risk levels, and teacher response strategies. The teacher detection results and the corresponding real-time monitoring data are encrypted into a second encrypted data packet. The second encrypted data packet is locally rolled and stored. An anomaly response is executed based on the teacher detection results, or the teacher detection results are encrypted into an anomaly warning notification and sent to the server in real time. Step S6: The server decrypts the received anomaly warning notification to obtain the teacher detection result, and executes an emergency response based on the teacher detection result; Step S7: Update the teacher and student models using the federated learning mechanism.

2. The method for early warning of anomalies in an energy metering device combined with edge computing as described in claim 1, characterized in that: In step S1, the data preprocessing layer is used to perform modal alignment and standardization on the input electrical quantity data, operating status data, environmental data and safety probe data, and output a four-modal tensor sequence with unified dimensions. The multimodal feature extraction layer is constructed based on an electrical quantity feature extraction module, an operational status feature extraction module, an environmental feature extraction module, and a safety probe feature extraction module. The electrical quantity feature extraction module extracts electrical quantity features from the four-modal tensor sequence using a temporal convolutional network and a bidirectional GRU. The operational status feature extraction module extracts operational status features from the four-modal tensor sequence using a graph convolutional network. The environmental feature extraction module extracts environmental features from the four-modal tensor sequence using a fully connected residual network. The safety probe feature extraction module extracts safety probe features from the four-modal tensor sequence using a multi-head self-attention network. The multi-level feature fusion layer is constructed based on a primary fusion module, an intermediate fusion module, and a high-level fusion module. The primary fusion module is used to perform weighted aggregation of electrical quantity features, operating status features, environmental features, and safety probe features through a modal attention mechanism to obtain initial fused features. The intermediate fusion module is used to enhance the initial fused features with complementary information through a cross-modal interaction gate to obtain intermediate fused features. The high-level fusion module is used to treat the intermediate fused features as a time-series signal through a temporal convolutional fusion block, and extract cross-modal temporal patterns from the time-series signal using 1D convolution to obtain high-level fused features. The anomaly risk detection layer is constructed based on an anomaly detection module and a risk level prediction module. The anomaly detection module is used to infer the high-level fusion features through a Gaussian mixture variational autoencoder to obtain the anomaly probability of different anomalies. The risk level prediction module is used to infer the high-level fusion features through a three-layer cascaded fully connected layer to obtain the risk level probability distribution of different anomalies. The response strategy generation layer is used to reason about the advanced fusion features and risk level probability distribution through a conditional generative adversarial network to obtain the response strategy for anomalies. The output layer is used to output detection results carrying anomaly items, risk levels, and response strategies based on anomaly probability, risk level probability distribution, and response strategies; the risk level is low risk, medium risk, or high risk. The formula for the loss function is: ; in, This represents the loss value of the loss function; The anomaly detection sub-loss is represented by the binary cross-entropy loss function. The risk level prediction sub-loss is represented by the classification cross-entropy loss function. The response strategy generates a sub-loss, which uses the standard adversarial loss function of conditional generative adversarial networks. Both represent hyperparameters.

3. The method for early warning of anomalies in an energy metering device combined with edge computing as described in claim 1, characterized in that: Step S2 specifically involves: Acquire a large amount of historical monitoring data from electricity metering devices installed in different environments and with varying service durations; The historical device monitoring data includes electrical quantity data, operating status data, environmental data, and safety probe data; The electrical quantity data includes at least basic AC electrical quantities and power quality parameters; The operational status data includes at least hardware self-test status, software operational status, and resource usage data; the environmental data includes at least temperature, humidity, air pressure, vibration, light intensity, location information, and external magnetic field strength; the security probe data includes at least firmware integrity verification values ​​and security event logs. The monitoring data of each historical device is preprocessed, including at least missing value handling, outlier handling, data alignment and time synchronization, data transformation and standardization. The preprocessed monitoring data of each historical device is labeled, including at least anomalies, risk levels and response strategies. A dataset is constructed based on the labeled monitoring data of each historical device.

4. The method for early warning of anomalies in an energy metering device combined with edge computing as described in claim 1, characterized in that: Step S3 specifically involves: The dataset is divided into a training set, a validation set, and a test set based on a preset ratio using stratified sampling. The device anomaly detection model is trained using the training set. During the training process, the device anomaly detection model is continuously optimized, including at least the learning rate, batch size, number of training rounds, number of hidden layers, number of neurons per layer, regularization parameters, and hyperparameters of the learning rate scheduling strategy, until the loss value of the loss function is less than a preset loss threshold. Precision, recall, F1-Score, AUROC, and prediction accuracy are calculated using the validation set to validate the trained device anomaly detection model. If the validation fails, the training set is expanded and training continues; if the validation passes, then: The confidence level and inference latency are calculated using the test set to test the validated device anomaly detection model. If the test fails, the training set is expanded for further training; if the test passes, then: The device anomaly detection model is used as the teacher model. A lightweight model architecture is selected as the student model based on the computational resource constraints of the power metering device. The model parameters of the student model are randomly initialized. The student model is trained using the output of the teacher model as soft labels through knowledge distillation. The trained student model is then subjected to performance verification including at least precision, recall, F1-Score, AUROC, and prediction accuracy to complete the compression of the device anomaly detection model. The teacher model is deployed to the TEE environment of the regional node, and the student model is deployed to the TEE environment of the power metering device connected to the regional node.

5. The method for early warning of anomalies in an energy metering device combined with edge computing as described in claim 1, characterized in that: Step S4 specifically involves: The electricity metering device collects real-time device monitoring data, including electrical quantity data, operating status data, environmental data, and safety probe data. The real-time device monitoring data is preprocessed by an adaptive wavelet denoising algorithm to filter out noise. The preprocessed real-time device monitoring data is then input into a deployed student model to obtain student detection results carrying student anomalies, student risk levels, and student response strategies. The electricity metering device obtains the current first timestamp and the first device serial number of the device, concatenates the first timestamp and the first device serial number into a first time series string, calculates the first hash value of the first time series string using the SHA-256 algorithm, and extracts the first 128 bits from the first hash value as a first dynamic key; concatenates the student detection results and real-time monitoring data into a first combined data block, calculates the second hash value of the first combined data block using the SHA-256 algorithm, and encrypts the first combined data block and the second hash value using the first dynamic key using the AES-128 algorithm to obtain first encrypted data; concatenates the first encrypted data, the first timestamp, and the first device serial number to obtain first concatenated data; extracts a first preset length of characters from the first timestamp based on a preset first truncation rule as a first obfuscation string, inserts the first obfuscation string into the first specified position of the first concatenated data to obtain first obfuscated data, and performs Base64 encoding on the first obfuscated data to obtain a first encrypted data packet; The electricity metering device continuously stores the first encrypted data packet to the local first hardware security module, calculates the first data fingerprint of the first encrypted data packet using the CRC32 algorithm, and uploads the first data fingerprint to the blockchain; The electricity metering device analyzes the student detection results. When the student risk level carried by the student detection results is low risk, it executes an abnormal response based on the student response strategy carried by the student detection results. Otherwise, it sends the first encrypted data packet to the regional node in real time via the TLS protocol.

6. The method for early warning of anomalies in an energy metering device combined with edge computing as described in claim 1, characterized in that: Step S5 specifically involves: The regional node receives the first encrypted data packet in real time. After obtaining the first data fingerprint from the blockchain and performing an integrity check on the first encrypted data packet, it decodes the first encrypted data packet using Base64 to obtain the first obfuscated data. Based on the first specified position and the first preset length, it locates the first obfuscated string. It removes the first obfuscated string from the first obfuscated data to obtain the first concatenated data. It parses the first concatenated data to obtain the first encrypted data, the first timestamp, and the first device serial number. It performs timeliness verification using the first timestamp and then legality verification using the first device serial number. It then concatenates the first timestamp and the first device serial number to form a first time sequence string. It calculates the first hash value of the first time sequence string using the SHA-256 algorithm. It extracts the first 128 bits from the first hash value as the first dynamic key. It calls the first dynamic key using the AES-128 algorithm to decrypt the first encrypted data to obtain the first combined data block and the second hash value. After performing a second integrity check on the first combined data block using the second hash value, it parses the first combined data block to obtain the student detection results and real-time monitoring data. The regional node parses the student detection results. When the student risk level carried by the student detection results is medium risk or high risk, the real-time monitoring data is input into the deployed teacher model to obtain the teacher detection results carrying teacher anomalies, teacher risk levels, and teacher response strategies. The teacher detection results and the corresponding real-time monitoring data are encrypted into a second encrypted data packet. The second encrypted data packet is continuously stored in the local second hardware security module. The second data fingerprint of the second encrypted data packet is calculated using the CRC32 algorithm and uploaded to the blockchain. The regional node parses the teacher detection results. When the teacher risk level carried by the teacher detection results is low risk or medium risk, it controls the corresponding power metering device to execute an abnormal response based on the teacher response strategy carried by the teacher detection results. When the teacher detection result carries a high risk level, the teacher detection result is encrypted into an abnormal warning notification, and the abnormal warning notification is sent to the server in real time via the TLS protocol.

7. The method for early warning of anomalies in an energy metering device combined with edge computing as described in claim 1, characterized in that: In step S5, encrypting the teacher's detection results and the corresponding real-time monitoring data into a second encrypted data packet specifically involves: The regional node obtains the current second timestamp and the second device serial number of the local machine, concatenates the second timestamp and the second device serial number into a second time series string, calculates the third hash value of the second time series string using the SHA-512 algorithm, and extracts the last 256 bits from the third hash value as the second dynamic key; concatenates the teacher detection results and real-time monitoring data into a second combined data block, calculates the fourth hash value of the second combined data block using the SHA-512 algorithm, and encrypts the second combined data block and the fourth hash value using the second dynamic key using the AES-256 algorithm to obtain second encrypted data; concatenates the second encrypted data, the second timestamp, and the second device serial number to obtain second concatenated data; based on a preset second truncation rule, extracts a second preset length of characters from the second timestamp as a second obfuscation string, inserts the second obfuscation string into the second specified position of the second concatenated data to obtain second obfuscated data, and performs Base64 encoding on the second obfuscated data to obtain a second encrypted data packet.

8. The method for early warning of anomalies in an energy metering device combined with edge computing as described in claim 6, characterized in that: In step S5, encrypting the teacher's detection result into an anomaly warning notification specifically involves: The regional node obtains the current third timestamp and the local device serial number, concatenates the third timestamp and the second device serial number to form a third time series string, calculates the fifth hash value of the third time series string using the SHA-512 algorithm, and extracts bits 4-259 from the fifth hash value as the third dynamic key; it then calculates the sixth hash value of the teacher detection result using the SHA-512 algorithm, and uses S... M4 The algorithm calls the third dynamic key to encrypt the teacher detection result and the sixth hash value to obtain the third encrypted data. The third encrypted data, the third timestamp, and the second device serial number are concatenated to obtain the third concatenated data. Based on the preset third truncation rule, the third preset length characters are truncated from the third timestamp as the third obfuscation string. The third obfuscation string is inserted into the third specified position of the third concatenated data to obtain the third obfuscated data. The third obfuscated data is Base64 encoded to obtain the abnormal warning notification.

9. The method for early warning of anomalies in an energy metering device combined with edge computing as described in claim 1, characterized in that: Step S6 specifically involves: The server receives the abnormal warning notification in real time, decrypts and verifies the abnormal warning notification to obtain the teacher detection result, parses the teacher detection result, and when the teacher risk level carried by the teacher detection result is high risk, it automatically triggers the preset emergency response mechanism based on the preset script to execute the emergency response and pushes the emergency response notification to the pre-associated management terminal.

10. The method for early warning of anomalies in an energy metering device combined with edge computing as described in claim 1, characterized in that: Step S7 specifically involves: Each regional node constructs an incremental dataset based on real-time device monitoring data from different electricity metering devices. The incremental dataset is labeled based on received abnormal response feedback. When the data volume of the incremental dataset reaches a preset threshold, the teacher model is trained and its performance is verified using the incremental dataset. The updated parameters of the teacher model are extracted, and the updated parameters are encrypted into encrypted parameters using a homomorphic encryption algorithm. The encrypted parameters are then uploaded to the server via the TLS protocol. The server aggregates the encrypted parameters uploaded by each regional node to obtain global model parameters, and then sends the global model parameters to each regional node via the TLS protocol. Each regional node updates the teacher model based on the global model parameters, and updates the student model of the corresponding power metering device after knowledge distillation of the global model parameters.

Images