Abnormal behavior detection method and device of power monitoring equipment based on machine learning, electronic equipment and storage medium

Abstract

The invention discloses an abnormal behavior detection method and device for power monitoring equipment based on machine learning, electronic equipment and a storage medium, and belongs to the technical field of power monitoring, and the method comprises the steps: obtaining response behavior data of to-be-detected power monitoring equipment after receiving a preset behavior verification signal; performing difference comparison calculation according to the response behavior data and preset reference behavior data, and determining a response difference value of the to-be-tested power monitoring equipment; under the condition that the response difference value exceeds a preset difference threshold value, obtaining an operation equipment log of the to-be-tested power monitoring equipment; performing word vector analysis on the running equipment log to generate a semantic feature vector of the to-be-tested power monitoring equipment; and inputting the semantic feature vector into a preset abnormal behavior detection model, and determining an abnormal behavior category of the to-be-detected power monitoring equipment. According to the invention, the problem of low maintenance efficiency of the power monitoring equipment in the prior art can be solved.

Description

Technical Field

[0001] This invention relates to the field of power monitoring technology, and specifically to a method, device, electronic device, and storage medium for detecting abnormal behavior of power monitoring equipment based on machine learning. Background Technology

[0002] As the front-end sensory and control mechanism of the power system, the stability of power monitoring equipment directly affects the safe dispatching and reliable power supply of the power grid. In recent years, with the rapid development of artificial intelligence technology, machine learning has been widely applied in the power industry, aiming to conduct in-depth statistical analysis and deep learning on massive, high-dimensional power system data. By deploying machine learning models to monitor the behavioral data of power monitoring equipment in real time, it is possible to effectively identify abnormal behaviors that deviate from normal patterns from complex data streams. This is of vital importance for timely detection of equipment hazards and for realizing the shift from reactive maintenance to predictive maintenance.

[0003] However, existing machine learning-based technologies for detecting abnormal behavior in power monitoring equipment still have significant limitations. Current detection solutions typically focus on solving binary classification problems, meaning they can only identify whether equipment behavior is abnormal, but often neglect to further refine the classification of the identified abnormal behavior. This approach prevents maintenance personnel from developing targeted repair plans based on the specific fault type before heading to the site for repairs, resulting in low efficiency in the maintenance of power monitoring equipment. Summary of the Invention

[0004] This invention provides a method, device, electronic device, and storage medium for detecting abnormal behavior of power monitoring equipment based on machine learning. This solves the problem that existing technologies can only identify the presence of abnormalities but cannot distinguish the types of abnormalities, resulting in low maintenance efficiency for power monitoring equipment.

[0005] One embodiment of the present invention provides a method for detecting abnormal behavior of power monitoring equipment based on machine learning, comprising: Acquire the response behavior data of the power monitoring device under test after receiving a preset behavior verification signal; Based on the response behavior data and the preset benchmark behavior data, a difference comparison calculation is performed to determine the response difference value of the power monitoring equipment under test. If the response difference value exceeds a preset difference threshold, the operating equipment log of the power monitoring equipment under test is obtained; Word vector analysis is performed on the logs of the operating equipment to generate semantic feature vectors for the power monitoring equipment under test; The semantic feature vector is input into a preset abnormal behavior detection model so that the abnormal behavior detection model can determine the abnormal behavior category of the power monitoring equipment under test based on the semantic feature vector; wherein, the abnormal behavior detection model is trained by training samples; each training sample includes historical semantic feature vectors and corresponding abnormal category labels.

[0006] Furthermore, based on the response behavior data and preset benchmark behavior data, a difference comparison calculation is performed to determine the response difference value of the power monitoring equipment under test, including: The response behavior data is analyzed to extract the actual response time and actual response content of the power monitoring device under test in response to the preset behavior verification signal. Based on the actual response time and the baseline response time contained in the preset baseline behavior data, the delay difference value of the power monitoring equipment under test is determined. Based on the actual response content and the baseline response content contained in the preset baseline behavior data, the content difference value of the power monitoring equipment under test is determined. The response difference value of the power monitoring equipment under test is determined based on the time delay difference value, the content difference value, and the preset weighting coefficient.

[0007] Furthermore, based on the actual response time and the baseline response time contained in the preset baseline behavior data, the delay difference value of the power monitoring equipment under test is determined, including: Determine whether the actual response time is greater than the baseline response time contained in the preset baseline behavior data. If not, the delay difference value of the power monitoring device under test is determined to be zero. If so, calculate the difference between the actual response time and the baseline response time to generate the timeout duration of the power monitoring device under test. Calculate the ratio of the timeout duration to the baseline response time to generate the delay difference value of the power monitoring device under test.

[0008] Furthermore, based on the actual response content and the baseline response content contained in the preset baseline behavior data, the content difference value of the power monitoring equipment under test is determined, including: The actual response content is parsed to identify the data type of the actual response content; If the data type of the actual response content is a status code type, then it is determined whether the actual response content is consistent with the baseline response content contained in the preset baseline behavior data; if they are inconsistent, based on the preset status code error level mapping table, the content difference value of the power monitoring device under test is determined according to the actual response content; if they are consistent, the content difference value of the power monitoring device under test is determined to be zero. If the data type of the actual response content is a binary bit sequence type, then calculate the Hamming distance between the actual response content and the baseline response content contained in the preset baseline behavior data to generate the mismatch bit number; calculate the ratio of the mismatch bit number to the binary sequence length of the baseline response content to generate the content difference value of the power monitoring device under test. If the data type of the actual response content is a numeric type, then the numerical deviation between the actual response content and the baseline response content contained in the preset baseline behavior data is calculated, and a numerical deviation value is generated. If the numerical deviation exceeds the preset tolerance threshold, the content difference value of the power monitoring equipment under test will be determined as the preset maximum difference value. If the numerical deviation value does not exceed the preset tolerance threshold, the content difference value of the power monitoring equipment under test will be determined as zero.

[0009] Furthermore, word vector analysis is performed on the operating equipment logs to generate semantic feature vectors for the power monitoring equipment under test, including: The logs of the operating equipment are cleaned to generate standardized log text; Standardized log text is segmented to extract a sequence of log words composed of several keywords; Based on a pre-defined word embedding model, determine the multi-dimensional numerical vector corresponding to each keyword in the log word sequence; The semantic feature vector of the power monitoring device under test is determined based on the multidimensional numerical vectors corresponding to all keywords in the log word sequence.

[0010] Furthermore, the abnormal behavior detection model is trained in the following way: Obtain several training samples; Each training sample is sequentially input into the abnormal behavior detection model to train the model until a preset number of training iterations are reached. Each time a training sample is received, the abnormal behavior detection model outputs the predicted abnormal behavior category corresponding to that sample. A loss function value is calculated based on the predicted abnormal behavior category and its corresponding label. The abnormal behavior detection model is then updated based on the loss function value.

[0011] Based on the above method embodiments, the present invention provides corresponding apparatus embodiments.

[0012] An embodiment of the present invention provides an abnormal behavior detection device for power monitoring equipment based on machine learning, comprising: a data acquisition module, a word vector analysis module, and an abnormal behavior detection module; The data acquisition module is used to acquire the response behavior data of the power monitoring device under test after receiving a preset behavior verification signal; perform difference comparison calculation based on the response behavior data and the preset benchmark behavior data to determine the response difference value of the power monitoring device under test; and acquire the operating equipment log of the power monitoring device under test when the response difference value exceeds a preset difference threshold. The word vector analysis module is used to perform word vector analysis on the operating equipment logs to generate semantic feature vectors of the power monitoring equipment under test. The abnormal behavior detection module is used to input semantic feature vectors into a preset abnormal behavior detection model, so that the abnormal behavior detection model can determine the abnormal behavior category of the power monitoring equipment under test based on the semantic feature vectors; wherein, the abnormal behavior detection model is trained by training samples; each training sample includes historical semantic feature vectors and corresponding abnormal category labels.

[0013] Furthermore, the data acquisition module performs a difference comparison calculation based on the response behavior data and preset benchmark behavior data to determine the response difference value of the power monitoring equipment under test, including: The response behavior data is analyzed to extract the actual response time and actual response content of the power monitoring device under test in response to the preset behavior verification signal. Based on the actual response time and the baseline response time contained in the preset baseline behavior data, the delay difference value of the power monitoring equipment under test is determined. Based on the actual response content and the baseline response content contained in the preset baseline behavior data, the content difference value of the power monitoring equipment under test is determined. The response difference value of the power monitoring equipment under test is determined based on the time delay difference value, the content difference value, and the preset weighting coefficient.

[0014] Based on the above method embodiments, the present invention provides corresponding electronic device embodiments.

[0015] An embodiment of the present invention provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the abnormal behavior detection method for power monitoring equipment based on machine learning as described in any of the above-described method embodiments.

[0016] Based on the above method embodiments, the present invention provides corresponding storage medium embodiments.

[0017] One embodiment of the present invention provides a storage medium storing a computer program thereon, wherein, when the computer program is running, it controls the device where the storage medium is located to execute any of the abnormal behavior detection methods for power monitoring equipment based on machine learning described in the above-described method embodiments.

[0018] Compared with the prior art, the present invention has the following beneficial effects: This invention provides a method, apparatus, electronic device, and storage medium for detecting abnormal behavior of power monitoring equipment based on machine learning. The method acquires response behavior data of the power monitoring equipment under test after receiving a preset behavior verification signal; performs a difference comparison calculation based on the response behavior data and preset baseline behavior data to determine the response difference value of the power monitoring equipment under test; if the response difference value exceeds a preset difference threshold, acquires the operating equipment log of the power monitoring equipment under test; performs word vector analysis on the operating equipment log to generate a semantic feature vector of the power monitoring equipment under test; and inputs the semantic feature vector into a preset abnormal behavior detection model to determine the abnormal behavior category of the power monitoring equipment under test.

[0019] This application obtains operational equipment logs when the detected response difference value exceeds a threshold, and uses word vector analysis technology to extract semantic feature vectors of the device under test. Furthermore, by inputting these semantic feature vectors into a pre-defined abnormal behavior detection model, it determines the specific abnormal behavior category, overcoming the limitation of existing technologies that can only identify the presence or absence of anomalies but cannot distinguish specific abnormal behavior categories. This application can provide maintenance personnel with accurate abnormal behavior classification criteria, enabling them to formulate targeted maintenance plans in advance, thereby effectively improving the maintenance efficiency of power monitoring equipment. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating an abnormal behavior detection method for power monitoring equipment based on machine learning, provided in an embodiment of the present invention.

[0021] Figure 2 This is a schematic diagram of the structure of an abnormal behavior detection device for power monitoring equipment based on machine learning, provided in an embodiment of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] like Figure 1As shown, to address the problem that existing technologies can only identify the presence of anomalies but cannot distinguish the types of anomalies, leading to low maintenance efficiency for power monitoring equipment, an embodiment of the present invention provides a method for detecting abnormal behavior of power monitoring equipment based on machine learning, comprising at least the following steps: Step S1: Obtain the response behavior data of the power monitoring device under test after receiving the preset behavior verification signal.

[0024] Specifically, this step, as the proactive trigger of the abnormal behavior detection process, aims to perceive the operational functions of the power monitoring equipment under test in real time through active detection. The power monitoring equipment under test refers to intelligent electronic devices that undertake data acquisition, protection control, or status monitoring tasks in the power system, specifically including microprocessor-based protection devices, power meters, distribution terminals, and phasor measurement units. To comprehensively assess the health status of the power monitoring equipment under test, a preset behavior verification signal is constructed as a request message conforming to power industry standard communication protocols, including IEC 61850, Modbus TCP, DNP3, and MQTT protocols. The preset behavioral verification signals are categorized into three types based on their detection focus: The first type focuses on detecting the connectivity of the communication link and the status of the business logic, manifested as heartbeat keep-alive messages or business status query commands. These query commands include read commands requesting the reading of specific register values ​​from the memory of the power monitoring device under test. The second type focuses on detecting the status of the underlying hardware interface and registers, manifested as hardware bitmap query commands used to scan the input states or relay output states of the device. The third type focuses on detecting the computing power of the device's computing unit, manifested as a computation challenge command. This command encapsulates a random number and requires the power monitoring device under test to perform a verification or hash operation on that random number. According to a preset detection cycle, the aforementioned preset behavioral verification signals are sent to the network address of the power monitoring device under test via the network interface.

[0025] At the instant the preset behavior verification signal is sent, the timestamp of the sending time is recorded (denoted as the first time T1). After receiving the preset behavior verification signal, the communication protocol stack and main control program of the power monitoring device under test will parse and process the signal and generate a corresponding feedback message. At the instant the feedback message returned by the power monitoring device under test is received, the timestamp of the receiving time is recorded (denoted as the second time T2). The response behavior data obtained at this time does not refer to the original binary message, but a data set that has undergone preliminary parsing and structured processing.

[0026] The received feedback messages are parsed to remove the physical and transport layer header encapsulation information, extracting the application layer payload as the actual response content. Simultaneously, the difference between the recorded first time point T1 and the second time point T2 is calculated to determine the actual response time of the power monitoring device under test. Therefore, the final obtained response behavior data contains two dimensions of information: the actual response time representing processing speed and network latency, and the actual response content representing the logical processing result. The data type of the actual response content has a strict correspondence with the type of the preset behavior verification signal sent: when a service status query command or heartbeat keep-alive message is sent, the obtained actual response content is a status code type representing the device's operating status; when a hardware bitmap query command is sent, the obtained actual response content is a binary bit sequence type representing the switch status; when a calculation challenge command is sent, the obtained actual response content is a numerical type representing the calculation result.

[0027] Through the above steps, we can actively sample the current activity and logic response capabilities of the power monitoring equipment under test with minimal network overhead and resource consumption, providing basic data support for subsequent difference comparison and anomaly diagnosis.

[0028] Step S2: Based on the response behavior data and the preset benchmark behavior data, perform a difference comparison calculation to determine the response difference value of the power monitoring equipment under test.

[0029] In a preferred embodiment, a difference comparison calculation is performed based on the response behavior data and preset benchmark behavior data to determine the response difference value of the power monitoring equipment under test, including: The response behavior data is analyzed to extract the actual response time and actual response content of the power monitoring device under test in response to the preset behavior verification signal. Based on the actual response time and the baseline response time contained in the preset baseline behavior data, the delay difference value of the power monitoring equipment under test is determined. Based on the actual response content and the baseline response content contained in the preset baseline behavior data, the content difference value of the power monitoring equipment under test is determined. The response difference value of the power monitoring equipment under test is determined based on the time delay difference value, the content difference value, and the preset weighting coefficient.

[0030] In a preferred embodiment, the delay difference value of the power monitoring device under test is determined based on the actual response time and the baseline response time contained in the preset baseline behavior data, including: Determine whether the actual response time is greater than the baseline response time contained in the preset baseline behavior data. If not, the delay difference value of the power monitoring device under test is determined to be zero. If so, calculate the difference between the actual response time and the baseline response time to generate the timeout duration of the power monitoring device under test. Calculate the ratio of the timeout duration to the baseline response time to generate the delay difference value of the power monitoring device under test.

[0031] In a preferred embodiment, the content difference value of the power monitoring device under test is determined based on the actual response content and the benchmark response content contained in the preset benchmark behavior data, including: The actual response content is parsed to identify the data type of the actual response content; If the data type of the actual response content is a status code type, then it is determined whether the actual response content is consistent with the baseline response content contained in the preset baseline behavior data; if they are inconsistent, based on the preset status code error level mapping table, the content difference value of the power monitoring device under test is determined according to the actual response content; if they are consistent, the content difference value of the power monitoring device under test is determined to be zero. If the data type of the actual response content is a binary bit sequence type, then calculate the Hamming distance between the actual response content and the baseline response content contained in the preset baseline behavior data to generate the mismatch bit number; calculate the ratio of the mismatch bit number to the binary sequence length of the baseline response content to generate the content difference value of the power monitoring device under test. If the data type of the actual response content is a numeric type, then the numerical deviation between the actual response content and the baseline response content contained in the preset baseline behavior data is calculated, and a numerical deviation value is generated. If the numerical deviation exceeds the preset tolerance threshold, the content difference value of the power monitoring equipment under test will be determined as the preset maximum difference value. If the numerical deviation value does not exceed the preset tolerance threshold, the content difference value of the power monitoring equipment under test will be determined as zero.

[0032] Specifically, this step aims to transform the raw response data obtained in step S1 into quantifiable numerical indicators, so as to accurately identify the abnormal state of the power monitoring equipment under test through a threshold judgment mechanism. In order to achieve health assessment, the difference comparison calculation is not a single-dimensional numerical subtraction, but a comprehensive consideration of both "timeliness" and "logical correctness".

[0033] First, the response behavior data obtained in step S1 is subjected to in-depth analysis. The header and tail verification information of the communication protocol are stripped away, and the actual response duration and actual response content of the power monitoring device under test in response to the preset behavior verification signal are extracted. At the same time, preset benchmark behavior data corresponding to the currently sent preset behavior verification signal is retrieved from the storage medium. The preset benchmark behavior data includes the benchmark response duration and benchmark response content under ideal conditions.

[0034] After data extraction, the first step is to calculate the difference in latency to quantify the performance degradation of the power monitoring equipment under test. Specifically, the extracted actual response time is compared with the baseline response time. If the actual response time is less than or equal to the baseline response time, it indicates that the current processing speed of the power monitoring equipment under test meets the performance requirements. In this case, the latency difference value (denoted as D_time) of the power monitoring equipment under test is directly set to zero, without penalty counting. If the actual response time is longer than the baseline response time, it indicates that the power monitoring equipment under test has a response lag. In this case, the difference between the actual response time and the baseline response time is calculated to obtain the timeout duration. To eliminate the impact of differences in the baseline time of different commands, the ratio of the timeout duration to the baseline response time is further calculated, and this ratio is used as the normalized latency difference value D_time. This calculation logic ensures that the latency difference value can objectively reflect the relative performance degradation ratio, rather than an absolute time difference.

[0035] Subsequently, content-level difference calculations are performed to quantify the degree of logical function error in the power monitoring equipment under test. Since the response content formats corresponding to different types of preset behavioral verification signals vary, it is necessary to first identify the data type of the actual response content and adopt an adaptive calculation strategy. If the data type of the actual response content is identified as a status code, it is directly determined whether the actual response content is numerically consistent with the baseline response content. If consistent, it indicates that the equipment status meets expectations, and the content difference value (denoted as D_content) of the power monitoring equipment under test is set to zero. If inconsistent, it indicates that the equipment is in an unexpected operating state. At this time, based on the pre-built status code error level mapping table, the error level value corresponding to the current actual response content is found, and this error level value is determined as the content difference value D_content, thereby distinguishing between minor warnings and serious faults. If the data type is identified as a binary bit sequence, the Hamming distance algorithm is used to calculate the number of inconsistent bits between the binary sequence of the actual response content and the binary sequence of the reference response content, generating a mismatch bit length. Then, the ratio of this mismatch bit length to the total length of the binary sequence of the reference response content is calculated, and this ratio is determined as the content difference value D_content, thereby accurately quantifying the proportion of local failures in the hardware interface or register. If the data type is identified as a numerical type, the absolute difference between the actual response content and the reference response content is calculated, generating a numerical deviation value. This numerical deviation value is compared with a preset tolerance threshold. If it exceeds the tolerance threshold, it indicates a serious error in the calculation logic, and the content difference value D_content is directly determined as the preset maximum difference value (e.g., 1.0). If it does not exceed the tolerance threshold, it is considered a fluctuation in calculation accuracy, and the content difference value D_content is determined to be zero.

[0036] Finally, to derive a single indicator comprehensively reflecting the health status of the power monitoring equipment under test, the difference values ​​of the two dimensions mentioned above are fused according to a preset weight configuration. A first weight coefficient (denoted as α) for the latency dimension and a second weight coefficient (denoted as β) for the content dimension are obtained, where the sum of the first weight coefficient α and the second weight coefficient β is 1. The response difference value of the power monitoring equipment under test (denoted as D_total) is calculated using the formula: D_total = α × D_time + β × D_content.

[0037] Through the above steps, the lag in response speed and logical errors in response content of the power monitoring equipment under test can be mapped into a unified quantitative indicator, thereby effectively avoiding the risk of missed or false alarms caused by single indicator detection, and ensuring that the subsequent high-computing power diagnostic process is triggered only when the equipment shows significant abnormal signs.

[0038] In an optional embodiment, the response behavior data is parsed to extract the actual response duration and actual response content of the power monitoring device under test in response to a preset behavior verification signal: First, to extract the actual response time, the first timestamp T1 of the sending time recorded in step S1 and the second timestamp T2 of the moment the feedback message was received are directly called. By calculating the numerical difference between the second timestamp T2 and the first timestamp T1, the millisecond-level physical time difference is obtained, and this time difference is directly marked as the actual response time of the power monitoring device under test for this preset behavior verification signal. This actual response time objectively reflects the transmission time of the signal in the network link and the sum of the interrupt response and processing time of the CPU inside the power monitoring device under test.

[0039] Meanwhile, extracting the actual response content requires performing a layered unpacking operation on the original feedback message. Specifically, according to pre-configured communication protocol stack rules, the physical layer frame header, link layer checksum trailer, network layer IP header, and transport layer TCP / UDP header are sequentially stripped from the feedback message, thereby exposing the payload data located at the application layer. This application layer payload is the core of the logical feedback from the power monitoring device under test to the verification command. To ensure the accuracy of the extracted content, the extraction process is not simply byte-stream interception, but rather a structured reading of the application layer payload using the corresponding decoding strategy based on the signal type determined when the preset behavioral verification signal is sent.

[0040] When the signal sent is a command focused on service status detection, the parsing logic identifies the application layer payload as a status code format and extracts a specific hexadecimal status word as the actual response content according to the protocol definition. This status word represents the device's operating mode or fault code. When the signal sent is a command focused on hardware interface detection, the parsing logic identifies the application layer payload as a binary bit sequence format and extracts a bit stream composed of 0s and 1s as the actual response content. Each bit in this bit stream represents the physical on / off state of a specific input or relay channel. When the signal sent is a computational challenge command focused on computing power detection, the parsing logic identifies the application layer payload as a numerical format and converts the byte stream into a specific decimal integer or floating-point number according to big-endian or little-endian mode as the actual response content. This numerical value represents the calculation result after the device performs a verification operation on the random number.

[0041] Through the above-mentioned targeted analysis and extraction based on signal type, the unstructured raw message is transformed into structured feature data that can be directly compared mathematically by a computer.

[0042] In an optional embodiment, the actual response content is parsed to identify its data type: Retrieve the signal identifier or function code recorded when sending the preset behavior verification signal in step S1, and search it in the preset signal type and response data type mapping table. If the currently sent signal identifier corresponds to a service status query instruction, the data type of the current actual response content is locked as a status code type; if it corresponds to a hardware interface scan instruction, it is locked as a binary bit sequence type; if it corresponds to a computing power verification instruction, it is locked as a numerical type. After determining the data type, perform targeted byte-level decoding operations on the actual response content according to the data structure definitions of different types.

[0043] When the data type of the actual response content is identified as a status code, the parsing logic reads the first two or four bytes of the application layer payload, according to the register bit width defined in the communication protocol. The read byte stream is then converted using hexadecimal encoding, reconstructing the original binary data into a standard status word with specific business meaning (e.g., 0x0000 or 0xFFFF). This parsing process ignores high-order padding zeros in the byte stream, retaining only the core status identifier bits, thus obtaining a standardized discrete status code for subsequent indexing and matching in the error level mapping table.

[0044] When the data type of the actual response content is identified as a binary bit sequence, the parsing logic initiates a bitmap expansion procedure. Each byte in the application layer payload is decomposed bit-by-bit in either high-order or low-order order, mapping each bit independently to a logical Boolean value. For example, a byte of 0xF0 is decomposed into a sequence of "11110000". Through this bit-by-bit expansion, a binary bit sequence with a length strictly consistent with the preset baseline data length is generated. Each "1" or "0" in this sequence precisely corresponds to the on / off state of a physical switch channel or logical flag bit of the power monitoring device under test.

[0045] When the data type of the actual response content is identified as numeric, the parsing logic concatenates the byte stream according to the preset endianness rules. If the protocol specifies big-endian mode, the high-address byte is used as the low-order byte of the value; if it specifies little-endian mode, the opposite is true. The concatenated byte stream is converted into a decimal integer or floating-point number, and the value is restored according to the scale factor agreed upon in the protocol. For example, the received original data is multiplied by 0.1 or 0.01 to restore the actual calculation result.

[0046] Through the above analysis steps, the originally obscure binary payload is restored to a decimal value that can directly participate in mathematical operations, providing an accurate minuend for subsequent calculations of numerical deviations.

[0047] Step S3: If the response difference value exceeds the preset difference threshold, obtain the operating equipment log of the power monitoring equipment under test.

[0048] Specifically, first, a pre-configured difference threshold is read from the storage unit. This difference threshold is a dimensionless value between 0 and 1, representing the maximum allowable performance fluctuation range and logic fault tolerance limit of the power monitoring device under test under normal operating conditions. The response difference value determined in step S2 is compared with this difference threshold. If the response difference value is less than or equal to the difference threshold, it indicates that the current response latency and content deviation of the power monitoring device under test are within an acceptable normal fluctuation range. At this time, the power monitoring device under test is determined to be operating normally, the log acquisition operation is not performed, and the process directly returns to step S1 to continue the active detection of the next cycle.

[0049] If the response difference value exceeds the difference threshold, it indicates that the power monitoring equipment under test has exhibited significant performance degradation or logical errors, at which point a log retrieval command is immediately triggered. The operational equipment log of the power monitoring equipment under test refers to unstructured data automatically recorded by the equipment during operation and stored in text format. Its content specifically includes system logs recording operating system kernel events, application logs recording the running status of business programs, communication logs recording summaries of communication interaction messages, and security logs recording access permission events. Each operational equipment log entry contains a precise timestamp, event severity level identifier, fault location information, and detailed semantic description text.

[0050] During the acquisition operation, to ensure that the acquired data is strongly correlated with the abnormal event and to reduce the amount of data transmission, instead of downloading all historical logs, a precise interception strategy based on a time window is adopted. Using the second time T2 recorded in step S1 as a reference point, a target time window covering the period before and after the abnormality is constructed by tracing back a first preset time period and extending forward a second preset time period. All log records falling within this target time window are retrieved from the storage space of the power monitoring device under test via a file transfer protocol or a remote log protocol, and this set of log records is marked as the target operating equipment log of the power monitoring device under test.

[0051] Through the above steps, an on-demand switch from lightweight active detection to heavyweight log analysis is achieved, which ensures that sufficient fault scene data can be obtained when an anomaly occurs, while avoiding network congestion and waste of computing resources caused by frequent transmission of massive logs during normal operation.

[0052] Step S4: Perform word vector analysis on the operating equipment logs to generate semantic feature vectors for the power monitoring equipment under test.

[0053] In a preferred embodiment, word vector analysis is performed on the operating equipment logs to generate semantic feature vectors for the power monitoring equipment under test, including: The logs of the operating equipment are cleaned to generate standardized log text; Standardized log text is segmented to extract a sequence of log words composed of several keywords; Based on a pre-defined word embedding model, determine the multi-dimensional numerical vector corresponding to each keyword in the log word sequence; The semantic feature vector of the power monitoring device under test is determined based on the multidimensional numerical vectors corresponding to all keywords in the log word sequence.

[0054] Specifically, this step, as the core feature extraction stage of anomaly diagnosis, aims to convert unstructured text data into a mathematical representation that deep learning models can understand. The operational logs of the power monitoring equipment under test typically contain a large amount of natural language descriptions, error codes, and meaningless formatting symbols. Directly inputting these into the model can lead to an explosion in computational dimensions and difficulty in convergence. Therefore, a standardized natural language processing procedure is required. First, the operational logs are cleaned to generate standardized log text. The text cleaning process includes not only removing timestamp information (e.g., "2023-10-01 12:00:01"), special punctuation marks (e.g., square brackets, colons), and stop words without actual semantic meaning (e.g., "the", "is", "at") from the operational logs, but also generalizing the dynamic variables in the logs. Specifically, specific IP addresses, port numbers, memory addresses, or process IDs in the operational logs are replaced with uniform placeholders (e.g., replacing "192.168.0.1" with "... <ip>This eliminates noise interference caused by specific numerical differences, while preserving the core semantic skeleton of the log, i.e., standardized log text.

[0055] After obtaining the standardized log text, word segmentation is performed to extract a sequence of log words composed of several keywords. The word segmentation process uses a pre-defined power industry-specific dictionary or a general word segmentation algorithm to divide the continuous text string into independent lexical units. For example, "Connection timeout" is segmented into two independent keywords: "Connection" and "timeout". Subsequently, based on a pre-defined word embedding model, a multi-dimensional numerical vector corresponding to each keyword in the log word sequence is determined. This pre-built word embedding model is a pre-constructed database mapping words to vectors. This model is pre-trained using Word2Vec, GloVe, or FastText algorithms based on a massive historical log corpus of power equipment. Each keyword is mapped to a fixed-dimensional floating-point array (e.g., a 64-dimensional or 128-dimensional real-number vector). If an uncommon word appears in the log word sequence that is not recorded in the model, it is mapped to a pre-defined unknown word vector to ensure the continuity of the processing flow.

[0056] Finally, the semantic feature vector of the power monitoring equipment under test is determined based on the multidimensional numerical vectors corresponding to all keywords in the log word sequence. Since the length of the log word sequence is not fixed, while the input layer of a neural network model typically requires fixed-dimensional input, it is necessary to aggregate the discrete multidimensional numerical vectors. Specific aggregation methods include using a weighted average method, which involves summing all multidimensional numerical vectors according to the term frequency-inverse document frequency (TF-IDF) weight of each keyword and taking the average; or using max pooling to extract the maximum value combination across all dimensions.

[0057] Through the above calculations, a fixed-length semantic feature vector is generated that represents the core semantic information of the entire log. These steps transform human-readable fault description text into computer-computable high-dimensional coordinates, enabling fault logs with different descriptions but similar semantics (such as "connection timeout" and "network unreachable") to cluster together in the feature space. This significantly improves the accuracy and robustness of subsequent anomaly classification.

[0058] Step S5: Input the semantic feature vector into the preset abnormal behavior detection model so that the abnormal behavior detection model can determine the abnormal behavior category of the power monitoring equipment under test based on the semantic feature vector; wherein, the abnormal behavior detection model is trained by training samples; each training sample includes historical semantic feature vectors and corresponding abnormal category labels.

[0059] In a preferred embodiment, the abnormal behavior detection model is trained in the following manner: Obtain several training samples; Each training sample is sequentially input into the abnormal behavior detection model to train the model until a preset number of training iterations are reached. Each time a training sample is received, the abnormal behavior detection model outputs the predicted abnormal behavior category corresponding to that sample. A loss function value is calculated based on the predicted abnormal behavior category and its corresponding label. The abnormal behavior detection model is then updated based on the loss function value.

[0060] Specifically, this step, as the final decision-making stage of the anomaly diagnosis process, aims to utilize trained artificial intelligence algorithms to analyze the high-dimensional patterns implicit in semantic feature vectors, thereby outputting specific abnormal behavior categories. The preset abnormal behavior detection model is a classifier built on a deep neural network architecture, containing an input layer, several hidden layers, and an output layer. During execution, the semantic feature vector of the power monitoring device under test generated in step S4 is transmitted as input data to the input layer of the abnormal behavior detection model. The data undergoes layer-by-layer weighted calculations and activation function processing within the model, ultimately generating a probability distribution vector at the output layer. Each element in this probability distribution vector corresponds to the confidence probability of six preset anomaly categories (i.e., communication anomaly data, equipment status anomaly data, signal anomaly data, power supply anomaly data, network anomaly data, and software logic anomaly data). The category with the highest probability value is selected as the final judgment result, and this category is marked as the abnormal behavior category of the power monitoring device under test.

[0061] To ensure the abnormal behavior detection model possesses accurate classification capabilities, it needs to be pre-trained using historical data in a supervised manner. The abnormal behavior detection model is trained using training samples, each of which includes a historical semantic feature vector and a corresponding abnormal category label. The construction process of the training samples is as follows: First, a massive amount of historical abnormal operation logs from power monitoring equipment are retrieved, and the word vector analysis processing flow is identical to that in step S4 to generate corresponding historical semantic feature vectors. Simultaneously, based on historical maintenance records, expert experience databases, or fault code definitions, each historical abnormal operation log is manually or semi-automatically categorized to generate corresponding abnormal category labels (e.g., using one-hot encoding). The paired historical semantic feature vectors and abnormal category labels are combined to form the training dataset for model learning.

[0062] In a preferred embodiment, the abnormal behavior detection model is trained through iterative optimization. First, a training set is formed by acquiring several training samples, and the network parameters (weights and biases) of the abnormal behavior detection model are randomly initialized. Then, a training loop is entered: training samples are input into the abnormal behavior detection model in batches or sequentially. Each time the abnormal behavior detection model receives a training sample (or a batch of samples), it performs forward propagation calculations and outputs the predicted abnormal behavior category (i.e., the predicted probability distribution) corresponding to that training sample. Next, the predicted abnormal behavior category is compared with the true abnormal category label inherent in the training sample. Based on the difference between the two, a loss function value is calculated using a preset loss function (e.g., cross-entropy loss function). This loss function value quantifies the degree of deviation between the model's current prediction result and the true result. Based on the loss function value, the gradient is calculated using the backpropagation algorithm, and a gradient descent optimizer is used to update and adjust the network parameters of the abnormal behavior detection model to reduce the prediction error in the next round. The above training process is repeated until the preset number of training iterations (Epochs) or the loss function value converges to the preset minimum value. At this point, the model parameters are saved, and the final usable abnormal behavior detection model is generated.

[0063] Through the above steps, an automatic mapping from data features to fault mechanisms is achieved, enabling the detection scheme to replace human experience and perform intelligent and automated accurate classification of complex faults in power monitoring equipment.

[0064] In an optional embodiment, the preset abnormal behavior detection model is a multi-classifier built on a Deep Neural Network (DNN) architecture. Its internal structure is designed to include an input layer, several hidden layers, and an output layer. The number of neurons in the input layer strictly corresponds to the dimension (e.g., 128-dimensional or 256-dimensional) of the semantic feature vector of the power monitoring device under test generated in step S4, to ensure that the high-dimensional semantic information after word embedding processing can be fully received. The hidden layers adopt a structure of alternating fully connected layers and non-linear activation functions (e.g., ReLU function) to map the input semantic features to a high-order abstract feature space. To prevent overfitting during training, dropout layers are also embedded between the hidden layers to randomly discard some neuron connections. The number of neurons in the output layer is set to six, corresponding to the six preset anomaly categories (i.e., communication anomaly data, device status anomaly data, signal anomaly data, power anomaly data, network anomaly data, and software logic anomaly data). The output layer uses the Softmax function as the activation function to transform the output value of the neural network into a normalized probability distribution vector. The value of each element in this vector represents the confidence level of the test log belonging to the corresponding anomaly category.

[0065] For the training process of this abnormal behavior detection model, a supervised learning iterative optimization strategy is adopted. First, a training set containing a large amount of historical data is constructed. Each training sample consists of a historical semantic feature vector corresponding to a historical abnormal operation log as the input feature (X), and a true abnormal category label (Y) of the log after manual or semi-automatic labeling as the target value. The true abnormal category label is represented using one-hot encoding. Before training begins, the model's weights and bias parameters are assigned values ​​using Xavier initialization or random initialization methods. Then, the iterative training phase begins. In each iteration, a batch of training samples is input into the model for forward propagation calculation, and the model outputs the predicted probability distribution based on the current parameters. Next, the cross-entropy loss function is used to calculate the difference between the predicted probability distribution and the true abnormal category label, i.e., the loss function value. Based on the loss function value, the gradient of the loss function with respect to each network parameter is calculated using the backpropagation algorithm. Then, combined with the Adam optimizer or stochastic gradient descent (SGD) optimizer, the network parameters of the model are updated along the direction of gradient descent. This process is repeated until the loss function value converges to a preset threshold or a preset number of iterations are reached, thus obtaining the trained abnormal behavior detection model.

[0066] In practical applications, this model acts as an intelligent translator from "log semantics" to "fault mechanisms." By inputting the real-time semantic feature vectors of the power monitoring equipment under test into the trained model, the model can automatically identify numerical patterns implicit in the feature vectors that are difficult for humans to perceive intuitively (for example, certain word vector combinations correspond to null pointer exceptions in software logic) and output the exception category with the highest probability. This setup allows the algorithm model to be closely integrated with the power monitoring scenario. The input data accurately represents the semantic content of the equipment logs, and the output data directly points to the specific fault attributes of the equipment, thereby realizing automated qualitative analysis of complex abnormal behaviors of power monitoring equipment without the need for manually writing cumbersome rule matching code.

[0067] In an optional embodiment, to achieve accurate qualitative analysis of power monitoring equipment faults, a pre-defined abnormal behavior detection model strictly divides abnormal behavior categories into six independent dimensions and quantifies them based on the semantic features implicit in the operating equipment logs. The core basis for this differentiation lies in the specific keyword combination patterns and semantic association structures that different types of faults exhibit in the log text. The model calculates the distance between the semantic feature vector to be tested and the center point of each abnormal category in the feature space, outputting a confidence vector containing six probability values. The category with the highest confidence is selected as the final result. Specifically, these six abnormal categories and their differentiation criteria are as follows.

[0068] First, communication anomaly data refers to transmission faults occurring at the physical or link layer of power monitoring equipment. Its semantic features in the logs are frequent occurrences of low-level communication terms such as "CRC check error," "parity check failure," "bus arbitration loss," or "physical port down." When the model detects a feature vector highly correlated with these low-level transmission error semantics, it classifies it as a communication anomaly. Second, equipment status anomaly data refers to a sub-healthy state where the equipment's hardware operating environment or physical parameters deviate from the normal range but have not yet been shut down. Its log semantic features focus on hardware health indicators such as "CPU temperature too high," "fan speed alarm," "memory usage exceeding threshold," or "disk bad sectors." The model classifies it as an equipment status anomaly based on these out-of-limit descriptions of hardware parameters. Third, signal anomaly data refers to quality problems with external analog or digital signals collected by the equipment. Its log features are manifested as "ADC sampling overflow," "input signal jitter," "sampling channel disconnection," or "transformer polarity error." The model classifies it as a signal anomaly by identifying specific fault terms in the data acquisition process.

[0069] Secondly, power supply anomaly data refers to voltage fluctuations or interruptions in the power supply module, which are described in the logs as "main power loss," "low battery voltage," "excessive power module ripple," or "voltage sag." The model classifies these as power supply anomalies by capturing semantic features directly related to voltage and current supply. Network anomaly data specifically refers to upper-layer network connection failures based on the TCP / IP protocol stack, distinct from lower-layer communication anomalies. Its log features are concentrated in "TCP connection timeout," "Socket creation failure," "IP address conflict," "DNS resolution error," or "gateway unreachable." The model classifies these as network anomalies by identifying protocol stack error semantics at the network and transport layers. Software logic anomaly data refers to logical errors or security violations generated during the execution of software programs running inside the device. Its log features are manifested as "null pointer reference," "array out of bounds," "deadlock," "file handle leak," or "authentication failure." The "Failed" model categorizes exceptions as software logic exceptions by identifying logical error descriptions in program stack information, exception-catching code, or security audit logs.

[0070] The final differentiation process is a clear and quantifiable one. The abnormal behavior detection model uses the Softmax function in the output layer to calculate the conditional probability that the tested semantic feature vector belongs to one of the six categories mentioned above. For example, if the output vector is [0.05, 0.02, 0.85, 0.03, 0.04, 0.01], the third element, 0.85, corresponds to the signal anomaly category. If this value exceeds a preset confidence threshold (e.g., 0.8), then the abnormal behavior is determined to be a signal anomaly. If the maximum probability value is lower than the preset threshold, "unknown anomaly" is output or a prompt for manual intervention is given. This differentiation method, based on deep semantic feature mapping and probability maximization decision-making, ensures that the anomaly classification results have a clear mathematical basis and interpretability.

[0071] Based on the above method embodiments, the present invention provides corresponding apparatus embodiments.

[0072] like Figure 2 As shown, an embodiment of the present invention provides an abnormal behavior detection device for power monitoring equipment based on machine learning, including: a data acquisition module, a word vector analysis module, and an abnormal behavior detection module; The data acquisition module is used to acquire the response behavior data of the power monitoring device under test after receiving a preset behavior verification signal; perform difference comparison calculation based on the response behavior data and the preset benchmark behavior data to determine the response difference value of the power monitoring device under test; and acquire the operating equipment log of the power monitoring device under test when the response difference value exceeds a preset difference threshold. The word vector analysis module is used to perform word vector analysis on the operating equipment logs to generate semantic feature vectors of the power monitoring equipment under test. The abnormal behavior detection module is used to input semantic feature vectors into a preset abnormal behavior detection model, so that the abnormal behavior detection model can determine the abnormal behavior category of the power monitoring equipment under test based on the semantic feature vectors; wherein, the abnormal behavior detection model is trained by training samples; each training sample includes historical semantic feature vectors and corresponding abnormal category labels.

[0073] It should be noted that the embodiments of the device described above correspond to the embodiments of the present invention described above, and can realize the abnormal behavior detection method of power monitoring equipment based on machine learning as described in any one of the above embodiments of the present invention. Furthermore, the embodiments of the device described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between modules indicates that they have a communication connection, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without creative effort.

[0074] Based on the above-described method embodiments of the present invention, a corresponding embodiment of an electronic device is provided.

[0075] An embodiment of the present invention provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the abnormal behavior detection method of power monitoring equipment based on machine learning as described in any one of the present invention, or the processor executes the computer program to implement the functions of each module in the above-described device embodiments.

[0076] For example, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to perform the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.

[0077] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0078] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0079] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the terminal device by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function, etc.; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital card (SD card), flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0080] Based on the above method embodiments, the present invention provides corresponding storage medium embodiments; Another embodiment of the present invention provides a storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the storage medium is located to execute any of the above-described abnormal behavior detection methods for power monitoring devices based on machine learning.

[0081] The aforementioned storage medium is a computer-readable storage medium, and the computer program includes computer program code, which may be in the form of source code, object code, executable file, or certain intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0082] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0083] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.< / ip>

Claims

1. A method for detecting abnormal behavior in power monitoring equipment based on machine learning, characterized in that, include: Acquire the response behavior data of the power monitoring device under test after receiving a preset behavior verification signal; Based on the response behavior data and the preset benchmark behavior data, a difference comparison calculation is performed to determine the response difference value of the power monitoring equipment under test. If the response difference value exceeds a preset difference threshold, the operating equipment log of the power monitoring equipment under test is obtained; Word vector analysis is performed on the logs of the operating equipment to generate semantic feature vectors for the power monitoring equipment under test; The semantic feature vector is input into a preset abnormal behavior detection model so that the abnormal behavior detection model can determine the abnormal behavior category of the power monitoring equipment under test based on the semantic feature vector; wherein, the abnormal behavior detection model is trained by training samples; each training sample includes historical semantic feature vectors and corresponding abnormal category labels.

2. The abnormal behavior detection method for power monitoring equipment based on machine learning as described in claim 1, characterized in that, Based on the response behavior data and the preset benchmark behavior data, a difference comparison calculation is performed to determine the response difference value of the power monitoring equipment under test, including: The response behavior data is analyzed to extract the actual response time and actual response content of the power monitoring device under test in response to the preset behavior verification signal. Based on the actual response time and the baseline response time contained in the preset baseline behavior data, the delay difference value of the power monitoring equipment under test is determined. Based on the actual response content and the baseline response content contained in the preset baseline behavior data, the content difference value of the power monitoring equipment under test is determined. The response difference value of the power monitoring equipment under test is determined based on the time delay difference value, the content difference value, and the preset weighting coefficient.

3. The abnormal behavior detection method for power monitoring equipment based on machine learning as described in claim 2, characterized in that, Based on the actual response time and the baseline response time contained in the preset baseline behavior data, the delay difference value of the power monitoring equipment under test is determined, including: Determine whether the actual response time is greater than the baseline response time contained in the preset baseline behavior data. If not, the delay difference value of the power monitoring device under test is determined to be zero. If so, calculate the difference between the actual response time and the baseline response time to generate the timeout duration of the power monitoring device under test. Calculate the ratio of the timeout duration to the baseline response time to generate the delay difference value of the power monitoring device under test.

4. The abnormal behavior detection method for power monitoring equipment based on machine learning as described in claim 3, characterized in that, Based on the actual response content and the baseline response content contained in the preset baseline behavior data, the content difference value of the power monitoring equipment under test is determined, including: The actual response content is parsed to identify the data type of the actual response content; If the data type of the actual response content is a status code type, then it is determined whether the actual response content is consistent with the baseline response content contained in the preset baseline behavior data; if they are inconsistent, based on the preset status code error level mapping table, the content difference value of the power monitoring device under test is determined according to the actual response content; if they are consistent, the content difference value of the power monitoring device under test is determined to be zero. If the data type of the actual response content is a binary bit sequence type, then calculate the Hamming distance between the actual response content and the baseline response content contained in the preset baseline behavior data to generate the mismatch bit number; calculate the ratio of the mismatch bit number to the binary sequence length of the baseline response content to generate the content difference value of the power monitoring device under test. If the data type of the actual response content is a numeric type, then the numerical deviation between the actual response content and the baseline response content contained in the preset baseline behavior data is calculated, and a numerical deviation value is generated. If the numerical deviation exceeds the preset tolerance threshold, the content difference value of the power monitoring equipment under test will be determined as the preset maximum difference value. If the numerical deviation value does not exceed the preset tolerance threshold, the content difference value of the power monitoring equipment under test will be determined as zero.

5. The abnormal behavior detection method for power monitoring equipment based on machine learning as described in claim 4, characterized in that, Word vector analysis is performed on the logs of the operating equipment to generate semantic feature vectors for the power monitoring equipment under test, including: The logs of the operating equipment are cleaned to generate standardized log text; Standardized log text is segmented to extract a sequence of log words composed of several keywords; Based on a pre-defined word embedding model, determine the multi-dimensional numerical vector corresponding to each keyword in the log word sequence; The semantic feature vector of the power monitoring device under test is determined based on the multidimensional numerical vectors corresponding to all keywords in the log word sequence.

6. The abnormal behavior detection method for power monitoring equipment based on machine learning as described in claim 5, characterized in that, The abnormal behavior detection model is trained using the following methods: Obtain several training samples; Each training sample is sequentially input into the abnormal behavior detection model to train the model until a preset number of training iterations are reached. Each time a training sample is received, the abnormal behavior detection model outputs the predicted abnormal behavior category corresponding to that sample. A loss function value is calculated based on the predicted abnormal behavior category and its corresponding label. The abnormal behavior detection model is then updated based on the loss function value.

7. An abnormal behavior detection device for power monitoring equipment based on machine learning, characterized in that, include: Data acquisition module, word vector analysis module, and abnormal behavior detection module; The data acquisition module is used to acquire the response behavior data of the power monitoring device under test after receiving a preset behavior verification signal; Based on the response behavior data and the preset benchmark behavior data, a difference comparison calculation is performed to determine the response difference value of the power monitoring equipment under test. If the response difference value exceeds a preset difference threshold, the operating equipment log of the power monitoring equipment under test is obtained; The word vector analysis module is used to perform word vector analysis on the operating equipment logs to generate semantic feature vectors of the power monitoring equipment under test. The abnormal behavior detection module is used to input semantic feature vectors into a preset abnormal behavior detection model, so that the abnormal behavior detection model can determine the abnormal behavior category of the power monitoring equipment under test based on the semantic feature vectors; wherein, the abnormal behavior detection model is trained by training samples; each training sample includes historical semantic feature vectors and corresponding abnormal category labels.

8. The abnormal behavior detection device for power monitoring equipment based on machine learning as described in claim 7, characterized in that, The data acquisition module performs a difference comparison calculation based on the response behavior data and preset benchmark behavior data to determine the response difference value of the power monitoring equipment under test, including: The response behavior data is analyzed to extract the actual response time and actual response content of the power monitoring device under test in response to the preset behavior verification signal. Based on the actual response time and the baseline response time contained in the preset baseline behavior data, the delay difference value of the power monitoring equipment under test is determined. Based on the actual response content and the baseline response content contained in the preset baseline behavior data, the content difference value of the power monitoring equipment under test is determined. The response difference value of the power monitoring equipment under test is determined based on the time delay difference value, the content difference value, and the preset weighting coefficient.

9. An electronic device, characterized in that, The device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the abnormal behavior detection method for a power monitoring device based on machine learning as described in any one of claims 1 to 6.

10. A storage medium, characterized in that, The storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the storage medium is located to perform the abnormal behavior detection method for power monitoring equipment based on machine learning as described in any one of claims 1 to 6.

Images