Lock control terminal data analysis method and system applied to intelligent management of transformer substation

Abstract

The embodiment of the application discloses a lock control terminal data analysis method and system applied to intelligent management of a transformer substation, the method comprising: collecting historical operation interaction data of each lock control terminal of the target transformer substation through a current distributed collection node, then adjusting the weight of the collection node according to the current state label of the lock control terminal, obtaining a target distributed collection node and collecting current operation interaction data, and then determining target operation interaction data; then, combining the operation rules of the transformer substation and the lock control logic, a deep reinforcement learning algorithm is used to extract features from the target operation interaction data, and the feature extraction strategy of the algorithm can be adaptively adjusted; then, the extracted lock control interaction features are input into an abnormality discrimination model to obtain a lock control state abnormality discrimination result, and based on this, early warning push information containing a cause-effect deduction knowledge graph and early warning decision keywords is generated; in this way, the accuracy and efficiency of data analysis are improved, and the safety and reliability of the transformer substation are enhanced.

Description

Technical Field

[0001] This application relates to the field of substation data analysis technology, and in particular to a method and system for analyzing lock control terminal data applied to intelligent management of substations. Background Technology

[0002] In the field of intelligent substation management, data analysis from interlocking terminals is crucial for ensuring the safe and stable operation of substations. As the core hub of the power system, substations undertake critical tasks such as voltage transformation, power distribution, and transmission; their operational safety and reliability directly affect the stable power supply of the entire power network. Interlocking terminals, as key components for controlling the operation permissions of substation equipment, ensure the proper functioning of their operation, preventing misoperation and guaranteeing equipment and personnel safety.

[0003] Analyzing the operational interaction data generated by the lock control terminal can promptly identify potential safety hazards, such as abnormal operational behavior and lock malfunctions. By taking proactive measures, the probability of accidents can be effectively reduced, ensuring the safe operation of the substation. Simultaneously, accurate data analysis can provide a scientific basis for substation equipment maintenance and management, enabling the rational planning of maintenance schedules and improving equipment lifespan and operational efficiency.

[0004] However, existing data analysis technologies for lock control terminals suffer from inaccuracy and inefficiency, making it difficult to ensure the safe and reliable operation of substations. Summary of the Invention

[0005] This application provides a data analysis method and system for lock control terminals applied to intelligent management of substations.

[0006] This application provides a data analysis method for lock control terminals in intelligent substation management, applied to a lock control terminal data analysis system. The method includes: collecting historical operation interaction data generated by each lock control terminal in a target substation through a current distributed acquisition node; adjusting the weights of the current distributed acquisition node corresponding to each lock control terminal based on its current status label to obtain a target distributed acquisition node, and collecting current operation interaction data generated by each lock control terminal; determining target operation interaction data based on the historical operation interaction data and the current operation interaction data; extracting lock control interaction features from the target operation interaction data using a deep reinforcement learning algorithm, combining the operating rules and lock control logic of the target substation; wherein the feature extraction strategy of the deep reinforcement learning algorithm is adaptively adjusted according to the interaction environment between the target substation and the lock control terminal; inputting the lock control interaction features into an anomaly discrimination model to obtain an anomaly discrimination result for the lock control status; and generating early warning push information for the target substation based on the anomaly discrimination result for the lock control status; wherein the early warning push information includes a causal derivation knowledge graph of the anomaly discrimination result for the lock control status and early warning decision keywords.

[0007] One embodiment of this application provides a lock control terminal data analysis system, including: a processor; a storage device storing a computer program thereon; and a network interface for providing network communication functions; when the computer program is executed by the processor, the processor implements any of the lock control terminal data analysis methods applied to intelligent management of substations.

[0008] One embodiment of this application provides a readable storage medium storing a program or instructions, which, when executed by a processor, implements the steps of the data analysis method for the lock control terminal applied to intelligent management of substations.

[0009] This application improves the efficiency and accuracy of data analysis for lock control terminals in intelligent substation management, thereby enhancing the overall safety and reliability of the substation. First, historical operation interaction data of each lock control terminal in the target substation is collected by the current distributed acquisition nodes. Based on this, the weights of the current distributed acquisition nodes are adjusted according to the current status label of each lock control terminal to obtain the target distributed acquisition node, which then collects the current operation interaction data. Finally, the target operation interaction data is determined. This adaptive weight adjustment mechanism makes data collection more accurate and efficient, enabling real-time capture of dynamic changes in the lock control terminals and comprehensively and accurately reflecting their operating status.

[0010] Then, combining the operating rules and interlocking logic of the target substation, a deep reinforcement learning algorithm is used to process the target operation interaction data. The feature extraction strategy of this algorithm can be adaptively adjusted according to the interaction environment between the target substation and the interlocking terminal. It can deeply mine the hidden features in the data that are closely related to interlocking safety. The adaptive feature extraction method breaks the limitations of the fixed strategy of traditional methods, can better adapt to the complex and ever-changing substation environment, and improve the sensitivity and identification ability of abnormal situations.

[0011] Finally, the extracted lock control interaction features are input into the anomaly detection model to obtain the anomaly detection results for the lock control status. Based on this, early warning push information containing a causal inference knowledge graph and early warning decision keywords is generated. The anomaly detection model integrates multimodal information, comprehensively considering the time series information, spatial location information, and operational context information of the lock control operation, constructing a multidimensional anomaly detection model that can accurately identify abnormal changes in the lock control status. The early warning push mechanism based on knowledge graphs and natural language processing transforms abnormal information into intuitive knowledge graphs and early warning information with decision-making guidance significance, and provides personalized pushes according to different management roles and responsibilities, improving the accuracy and response speed of substation management decisions.

[0012] Overall, this application's embodiments achieve comprehensive, real-time, and accurate monitoring of the substation interlocking terminal's operational status by constructing an adaptive data acquisition architecture, intelligent feature extraction algorithms, precise anomaly identification models, and efficient early warning push mechanisms. This not only enables timely detection of potential anomalies and reduces the likelihood of potential faults, but also provides managers with accurate and reliable decision-making support, optimizes system reliability and maintenance efficiency, and enhances the overall safety monitoring capabilities of the substation. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 A flowchart illustrating a data analysis method for a lock control terminal applied to intelligent management of substations, provided as an embodiment of this application;

[0015] Figure 2 This is a schematic diagram of the basic structure of a lock control terminal data analysis system provided in an embodiment of this application;

[0016] Figure 3A functional block diagram of a lock control terminal data analysis device for intelligent management of substations provided in this application embodiment;

[0017] Figure 4 This is a schematic diagram of an interactive scenario architecture provided in an embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0019] Please see Figure 1 , Figure 1 This is a flowchart of a data analysis method for a lock control terminal applied to intelligent management of substations, provided by an embodiment of this application. The method can be executed by the lock control terminal data analysis system, or by the lock control terminal data analysis system and the server together. The method may include steps S110-S140.

[0020] Step S110: Collect historical operation interaction data generated by each lock control terminal of the target substation through the current distributed acquisition node.

[0021] In the data analysis scenario of lock control terminals in intelligent substation management, there are multiple lock control terminals within the target substation, which continuously generate operational interaction data during daily operation. The distributed acquisition nodes are devices pre-deployed at various key locations within the target substation, possessing data acquisition capabilities. Each distributed acquisition node is responsible for collecting historical operational interaction data generated by lock control terminals that are geographically close or have superior network connectivity.

[0022] Historical operation interaction data encompasses various operational information of the lock control terminal over a past period. For example, it includes the specific time of each operation, accurately recording the moment it occurred and reflecting temporal patterns; the type of operation, including different actions such as unlocking, locking, and authorization verification; and the result of the operation, i.e., whether it was successfully completed or failed. This historical operation interaction data is stored internally in the lock control terminal as data records. The distributed collection nodes collect this data by establishing data transmission channels with the lock control terminal.

[0023] During data acquisition, the current distributed acquisition nodes will proactively initiate data requests to the lock control terminal at regular time intervals or when new operation interaction data is detected. Upon receiving the request, the lock control terminal will send the stored historical operation interaction data to the corresponding current distributed acquisition node. After receiving the data, the current distributed acquisition node will perform preliminary verification and processing to ensure data integrity and accuracy. Then, it will temporarily store this data in a local cache, awaiting further processing and analysis.

[0024] Step S120: Based on the current status tag of each lock terminal, adjust the weight of the current distributed acquisition node corresponding to each lock terminal to obtain the target distributed acquisition node, and collect the current operation interaction data generated by each lock terminal. Determine the target operation interaction data based on the historical operation interaction data and the current operation interaction data.

[0025] Step S121: parse the current status label of each lock terminal, extract the status feature index that characterizes the operational stability of the lock terminal, and construct the acquisition node weight evaluation function based on the status feature index.

[0026] Each lock control terminal is assigned a current status label, which is a comprehensive description of the terminal's current operating state. The current status label contains various information related to the stability of the lock control terminal's operation, and it needs to be parsed to extract key status characteristic indicators.

[0027] The parsing process involves analyzing the format and content of the current status labels to identify fields related to operational stability. For example, the operation success rate reflects the proportion of successful operations performed by the lock control terminal within a certain timeframe; a higher success rate indicates more stable operation. The operation frequency is the number of times the lock control terminal performs operations per unit time; a stable operation frequency indicates that the lock control terminal is operating in a relatively stable state. The number of abnormal operations records the number of abnormal operations that occurred; fewer abnormal operations indicate better operational stability.

[0028] After extracting the aforementioned state characteristic indicators, a data acquisition node weight evaluation function needs to be constructed based on them. The purpose of this function is to determine the importance of each currently distributed data acquisition node based on these state characteristic indicators. During the construction process, the influence of each state characteristic indicator on the data acquisition node weight needs to be considered. For example, the operation success rate may have a significant impact on the data acquisition node weight because it directly reflects the operational reliability of the lock terminal; while the operation frequency and the number of abnormal operations have relatively smaller impacts, but they cannot be ignored. By comprehensively considering these factors and rationally combining and calculating the state characteristic indicators, a function that can accurately evaluate the weight of the data acquisition nodes can be constructed.

[0029] Step S122: After eliminating the dimensional differences of the historical data acquisition accuracy and data transmission delay parameters of the current distributed acquisition node, input them into the node weight evaluation function to calculate the dynamic weight value of each current distributed acquisition node.

[0030] The historical data acquisition accuracy and data transmission latency of the current distributed acquisition nodes are important indicators for evaluating their performance, but these two parameters have different dimensions. The historical data acquisition accuracy is usually expressed as a percentage, reflecting the proportion of data accurately acquired by the current distributed acquisition node in the past data acquisition process to the total data volume; while the data transmission latency parameter is in units of time, measuring the time it takes for data to be transmitted from the lock terminal to the current distributed acquisition node.

[0031] To ensure these two parameters are appropriately input into the node weight evaluation function, they need to be processed to eliminate dimensional differences. This can be achieved using normalization or standardization methods. Normalization maps the data to a defined interval, for example, mapping historical data collection accuracy and data transmission latency parameters to the interval between 0 and 1, making them numerically comparable. Standardization, on the other hand, calculates the mean and standard deviation of the data, transforming it into a standard normal distribution with a mean of 0 and a standard deviation of 1, thereby eliminating the influence of dimensions.

[0032] After dimensional difference elimination processing, these two parameters are input into the previously constructed node weight evaluation function. The node weight evaluation function calculates the dynamic weight value of each current distributed acquisition node based on the input parameters and the influence degree of each previously determined state characteristic index. The dynamic weight value reflects the importance of the current distributed acquisition node relative to other nodes at the current moment; the higher the weight value, the more critical the node is in the data acquisition process.

[0033] Step S123: Prioritize the current distributed acquisition nodes based on the dynamic weight values, and select the preset number of distributed acquisition nodes with the highest weight values ​​as target distributed acquisition nodes.

[0034] After obtaining the dynamic weight value of each current distributed data acquisition node, it is necessary to prioritize all current distributed data acquisition nodes. The ranking is based on the magnitude of the dynamic weight value, arranged from high to low.

[0035] The sorting process can employ common sorting algorithms, such as bubble sort and quicksort. Through sorting, the importance ranking of each current distributed data collection node within the overall system can be accurately determined.

[0036] Then, based on preset quantity requirements, several nodes with the highest weight values ​​are selected from the sorted list of current distributed data acquisition nodes as target distributed data acquisition nodes. The preset quantity is determined based on actual data analysis needs and system resource limitations. The purpose of selecting target distributed data acquisition nodes is to improve data acquisition efficiency and resource utilization while ensuring data acquisition quality. Because nodes with higher weight values ​​typically perform better in terms of data acquisition accuracy and timeliness, selecting these nodes as target distributed data acquisition nodes ensures the quality of the collected current operational interaction data.

[0037] Step S124: Collect the current operation interaction data generated by each lock control terminal through the target distributed acquisition node. The current operation interaction data includes the operation execution time sequence, operation type identifier and operation result status code.

[0038] Once the target distributed data acquisition node is identified, it will immediately begin collecting the current operation interaction data generated by each lock control terminal. This current operation interaction data contains information about the operations that the lock control terminal is currently performing or has just completed.

[0039] An operation execution time series records each point in time from the start to the end of an operation, accurately reflecting the execution process and time span. For example, an unlocking operation may require multiple steps such as authorization verification and lock unlocking, each with its corresponding time point, which constitute the operation execution time series.

[0040] Operation type identifiers are used to distinguish different operation behaviors, represented by a set code or symbol. For example, unlocking an operation can be represented by "01", locking an operation by "02", and authorization verification by "03", etc. Operation type identifiers allow for quick identification of the specific type of operation.

[0041] The operation result status code is a quantitative representation of the final result of the operation. It can be divided into two cases: success and failure. The successful operation result status code can be represented by a set value or code, such as "1". The failure operation result status code can be further subdivided according to different failure reasons. For example, permission verification failure can be represented by "2", and operation failure caused by lock body failure can be represented by "3", etc.

[0042] The target distributed acquisition nodes establish a real-time data transmission channel with the lock control terminal. When a new operation is detected on the lock control terminal, the nodes promptly acquire the current operation interaction data. During the acquisition process, the target distributed acquisition nodes perform real-time verification and processing of the data to ensure its accuracy and completeness. Then, the acquired current operation interaction data is sent to the data processing center for further analysis.

[0043] Step S125: Perform time axis calibration processing on the historical operation interaction data and the current operation interaction data. Based on the time axis calibration result, replace the part of the historical operation interaction data that overlaps with the current operation interaction data with the current operation interaction data to generate target operation interaction data containing a complete time series.

[0044] Historical operation interaction data and current operation interaction data were collected at different points in time, and their time ranges may overlap. In order to effectively integrate these two types of data, timeline calibration processing is required.

[0045] The timeline calibration process involves first determining the time range of historical and current operation interaction data, and then identifying the overlapping time periods between them. This process requires precise comparison and analysis of the specific time points of the operations. For example, if historical operation interaction data records the operation information of a lock terminal over the past week, while current operation interaction data records the operation information of the same lock terminal today, then it is necessary to find the corresponding portion of today's time period in the historical operation interaction data.

[0046] Based on the timeline calibration results, the portion of historical operation interaction data that overlaps with the current operation interaction data is replaced with the current operation interaction data. This is because the current operation interaction data is the latest and most accurate operation information, and using it to replace the data in the same time period in the historical operation interaction data can ensure the timeliness and accuracy of the data.

[0047] After replacement processing, historical and current operation interaction data are integrated to generate target operation interaction data containing a complete time series. This target operation interaction data covers all operation information from the time the lock terminal is put into use to the current moment, and the time series is continuous and complete.

[0048] Step S130: Combining the operation rules and interlocking logic of the target substation, use a deep reinforcement learning algorithm to extract features from the target operation interaction data to obtain interlocking interaction features; wherein, the feature extraction strategy of the deep reinforcement learning algorithm is adaptively adjusted according to the interaction environment between the target substation and the interlocking terminal.

[0049] Step S131: Input the target operation interaction data into the experience replay pool of the deep reinforcement learning algorithm, and generate an initial state space by combining it with the operation rules of the target substation. The initial state space includes the operation sequence features of the lock control terminal and the associated features of the substation equipment.

[0050] In deep reinforcement learning algorithms, the experience replay pool is a crucial component for storing and managing data. Target action interaction data is input into the experience replay pool, where it is stored and organized for algorithm processing.

[0051] The target substation has its own set operating rules, which are formulated based on the substation's design requirements, safety standards, and actual operating experience. By combining these operating rules, relevant information is extracted from the target operation interaction data to generate an initial state space.

[0052] The initial state space contains two important features: the operation sequence features of the lock control terminal and the association features of substation equipment. The operation sequence features of the lock control terminal are obtained by analyzing the order and combination of operations in the target operation interaction data. For example, if a lock control terminal performs an authorization verification operation first and then an unlocking operation within a certain period, the order of these operations constitutes the operation sequence feature. The operation sequence feature can reflect the operating habits and modes of the lock control terminal.

[0053] Substation equipment association features consider the relationships between the lock control terminal and other equipment within the target substation. For example, if a lock control terminal controls the door lock of a designated area, and that area is associated with a critical piece of equipment in the substation, then this association needs to be taken into account when generating the initial state space. Substation equipment association features are used to analyze the impact of lock control terminal operations on the overall operation of the substation equipment.

[0054] Step S132: Call the policy mapping branch of the deep reinforcement learning algorithm to perform feature mapping processing on the initial state space, and generate a policy function containing the probability distribution of operation intentions. The number of output layer neurons of the policy function is consistent with the number of lock operation types.

[0055] The policy mapping branch of a deep reinforcement learning algorithm is an important component of the algorithm, and its main function is to perform feature mapping processing on the input initial state space.

[0056] Once the initial state space is input into the policy mapping branch, the branch transforms and maps the features in the initial state space through a series of calculations and processes. During this process, the policy mapping branch learns the relationships and patterns between different features in the initial state space.

[0057] The generated policy function includes the probability distribution of operation intentions. This probability distribution represents the likelihood of performing various locking operations in the current initial state space. For example, in a given initial state, the probability of unlocking is 0.6, the probability of locking is [missing value], and the probability of authentication is 0.1.

[0058] The number of output layer neurons in the policy function is the same as the number of locking operation types. This is because each output layer neuron corresponds to one locking operation type, and its output value represents the probability of performing that locking operation. In this way, the policy function can accurately reflect the probability of various locking operations under different initial states.

[0059] Step S133: Construct a reward function based on the lock control logic. The reward function calculates an instant reward value based on the degree of compliance between the operation execution result and the substation safety rules. The higher the degree of compliance, the greater the instant reward value.

[0060] The interlocking logic refers to the rules and procedures established by the target substation for interlocking operations to ensure equipment safety and normal operation. A reward function is constructed based on the interlocking logic. The purpose of the reward function is to calculate an immediate reward value based on the degree to which the operation execution result conforms to the substation's safety rules.

[0061] First, the specific content of the substation safety rules needs to be clearly defined. For example, in certain designated areas, only authorized personnel can perform unlocking operations; before unlocking, valid authorization verification must be performed, etc.

[0062] After the locking terminal performs an operation, the reward function evaluates the result. This evaluation compares the result with the substation's safety rules to determine if the operation complies. If the operation fully complies with the safety rules (high compliance), the reward function outputs a large immediate reward value. If the operation partially complies with the safety rules, the reward function outputs a relatively small immediate reward value. If the operation completely violates the safety rules, the reward function outputs a negative immediate reward value.

[0063] For example, if a lock control terminal performs a lock unlocking operation and first correctly verifies the permissions and the operator has the appropriate authorization, then the operation complies with the substation's safety rules, and the reward function will award a large positive immediate reward value. Conversely, if no permission verification is performed during the lock unlocking operation, then the operation violates the safety rules, and the reward function will award a negative immediate reward value. In this way, the reward function can incentivize deep reinforcement learning algorithms to learn operating strategies that comply with the substation's safety rules.

[0064] Step S134: Evaluate the probability distribution of the operation intent output by the policy function through the state value evaluation branch of the deep reinforcement learning algorithm to generate a state value function. The state value function is used to predict the cumulative reward value of the current operation sequence in the future time window.

[0065] The state value evaluation branch of a deep reinforcement learning algorithm is responsible for evaluating the value of the operation intention probability distribution output by the policy function. After the policy function outputs the operation intention probability distribution, the state value evaluation branch evaluates the value of the current operation sequence within a future time window based on these probability distributions and the current state information.

[0066] The state value assessment branch takes into account the potential rewards of different operations in the future. For example, if the current sequence of operations shows a high probability of performing an unlocking operation, the state value assessment branch will predict the potential rewards of the unlocking operation in the near future, including the immediate reward value obtained from complying with security rules and the reward values ​​from other operations that may follow.

[0067] By comprehensively calculating and predicting these possible reward values, a state value function is generated. The state value function is a function used to predict the cumulative reward value of the current operation sequence within a future time window. It helps deep reinforcement learning algorithms determine the quality of the current operation sequence and thus select a better operation strategy. For example, if an operation sequence has a high cumulative reward value within a future time window, it indicates that the operation sequence is a better strategy, and the deep reinforcement learning algorithm will be more inclined to choose this operation sequence.

[0068] Step S135: Update the parameter weights of the policy mapping branch according to the instant reward value and the state value function, and train the policy function through multiple iterations to converge to the optimal feature extraction policy. Use the converged policy mapping branch to extract features from the target operation interaction data to obtain the lock control interaction features.

[0069] After obtaining the immediate reward value and state value function, the parameter weights of the policy mapping branch need to be updated based on them. The purpose of updating the parameter weights is to enable the policy mapping branch to learn a better feature extraction policy, thereby improving the performance of the deep reinforcement learning algorithm.

[0070] The specific update process involves using the immediate reward value and the state value function as feedback information, and then calculating the update amount of the parameter weights using a specific algorithm. For example, a gradient descent algorithm can be used to calculate the gradient of the parameter weights based on the difference between the immediate reward value and the state value function, and then adjust the parameter weights according to the direction of the gradient.

[0071] Through multiple iterations of training, the parameter weights of the policy mapping branch are continuously updated. In each iteration, the deep reinforcement learning algorithm randomly selects a certain number of samples from the experience replay pool for training, calculates the immediate reward value and state value function, and then updates the parameter weights. As the number of iterations increases, the policy function gradually converges to the optimal feature extraction policy.

[0072] Once the policy function converges, the converged policy mapping branch is used to extract features from the target operation interaction data. This policy mapping branch extracts key features related to locking operations from the target operation interaction data; these features are called locking interaction features. Locking interaction features accurately reflect important information related to locking operations within the target operation interaction data.

[0073] Step S140: Input the lock control interaction features into the anomaly discrimination model to obtain the lock control state anomaly discrimination result, and generate early warning push information for the target substation based on the lock control state anomaly discrimination result; wherein, the early warning push information includes a causal derivation knowledge graph of the lock control state anomaly discrimination result and early warning decision keywords.

[0074] Step S141: Perform dimensional standardization processing on the lock control interaction features, map the feature values ​​to a preset numerical range, and generate a standardized lock control interaction feature vector.

[0075] Lock interaction features are a set of features extracted from target operation interaction data, and the value ranges of these features may vary. In order for anomaly detection models to better handle these features, the lock interaction features need to be dimensionality standardized.

[0076] Dimensional normalization involves mapping the feature values ​​of the lock interaction characteristics to a preset numerical range. For example, mapping feature values ​​to the range of 0 to 1. A specific mapping method can be a linear transformation, which calculates the minimum and maximum values ​​of the feature values ​​and transforms each feature value to the preset numerical range according to a certain ratio.

[0077] After dimensionality standardization, the lock interaction features are converted into standardized lock interaction feature vectors. Each element in the standardized lock interaction feature vector falls within a preset numerical range, which eliminates the dimensional differences between different features. This allows the anomaly detection model to treat each feature more fairly, improving the model's accuracy.

[0078] Step S142: Input the standardized lock control interaction feature vector into the feature selection layer of the anomaly detection model to calculate the weight coefficient of each feature dimension, retain the feature dimensions with weight coefficients greater than the preset coefficient, and generate the dimensionality-reduced key lock control interaction features.

[0079] The main function of the feature selection layer in the anomaly detection model is to filter features from the input standardized lock interaction feature vector. After the standardized lock interaction feature vector is input into the feature selection layer, the feature selection layer calculates the weight coefficient of each feature dimension according to a certain algorithm.

[0080] The weight coefficients reflect the importance of each feature dimension in anomaly detection. The feature selection layer comprehensively considers factors such as feature relevance and dissimilarity when calculating the weight coefficients. For example, feature dimensions that are highly correlated with lock status anomalies will have relatively larger weight coefficients, while feature dimensions that are less related to anomaly detection will have relatively smaller weight coefficients.

[0081] The preset coefficient is a pre-defined threshold used to determine the importance of a feature dimension. The calculated weight coefficient is compared with the preset coefficient, and feature dimensions with a weight coefficient greater than the preset coefficient are retained, while feature dimensions with a weight coefficient less than or equal to the preset coefficient are discarded.

[0082] After feature filtering, key lock-control interaction features with reduced dimensionality are generated. These features only include the dimensions most important for anomaly detection, reducing data dimensionality, improving data processing efficiency, and avoiding interference from irrelevant features in the anomaly detection results.

[0083] Step S143: Call the bidirectional long short-term memory network layer of the anomaly discrimination model to model the temporal dependency relationship of the key locking interaction features, and extract steady-state dependency features and transient fluctuation features.

[0084] Step S1431: Arrange the key lock control interaction features into a feature sequence according to time order, and divide the feature sequence into multiple time window sub-sequences.

[0085] Key lock control interaction features contain the operation information of the lock control terminal at different points in time. In order to analyze the temporal dependencies between these features, the key lock control interaction features need to be arranged in chronological order to form a feature sequence.

[0086] Then, the feature sequence is divided into multiple time window subsequences. The division of time window subsequences is determined based on actual analytical needs and data characteristics. For example, the feature sequence can be divided into a time window subsequence according to the length of each time period. Each time window subsequence contains the key locking interaction features within that time period. In this way, the changes and dependencies of features in different time periods can be accurately analyzed.

[0087] Step S1432: Input each time window subsequence into the forward propagation unit of the bidirectional long short-term memory network layer to calculate the forward hidden state sequence, which contains the feature dependencies from the beginning of the sequence to the current position.

[0088] The forward propagation unit in a bidirectional long short-term memory network is a crucial component for processing time series data. Each time window subsequence is sequentially input into the forward propagation unit, which then processes the input data.

[0089] During forward propagation, the forward propagation unit calculates the hidden state of the current time step based on the current input data and the hidden state of the previous time step. Through continuous iterative calculation, a forward hidden state sequence is obtained. The forward hidden state sequence records the feature dependencies from the beginning of the sequence to the current position, reflecting the cumulative influence and changing trend of features over time. For example, in a time window subsequence, information from previous operations will affect subsequent operations, and the forward hidden state sequence can capture this influence.

[0090] Step S1433: Input each time window subsequence in reverse order into the backpropagation unit of the bidirectional long short-term memory network layer to calculate the reverse hidden state sequence, which contains the feature dependencies from the end of the sequence to the current position.

[0091] Corresponding to the forward propagation unit, the bidirectional long short-term memory network layer also contains a backpropagation unit. Each time window subsequence is input into the backpropagation unit in reverse order, and the backpropagation unit processes the input data in reverse chronological order.

[0092] The backpropagation unit also calculates the hidden state of the current time step based on the current input data and the hidden state of the previous time step (in the case of reverse order). Through continuous iterative calculation, a sequence of reverse hidden states is obtained. The sequence of reverse hidden states contains the feature dependencies from the end of the sequence to the current position, and can capture the influence and changes of features in reverse time order. For example, information from later operations may have a feedback effect on earlier operations, and the sequence of reverse hidden states can reflect this feedback relationship.

[0093] Step S1434: Perform bit-by-bit concatenation on the forward hidden state sequence and the reverse hidden state sequence to generate a fused hidden state matrix containing bidirectional dependency information.

[0094] After obtaining the forward hidden state sequence and the backward hidden state sequence, they need to be concatenated bit by bit. Bit-by-bit concatenation involves combining the hidden states of the forward and backward hidden state sequences at the same time step to form a new vector.

[0095] A fused hidden state matrix is ​​generated through bitwise concatenation. This matrix contains feature dependency information in both the forward and reverse directions, providing a more comprehensive reflection of the temporal dependencies of key locking interaction features. This bidirectional dependency information is crucial for analyzing anomalies in the locking state, as such anomalies may be influenced by both past and future operations.

[0096] Step S1435: Decompose the fused hidden state matrix using a preset time scale separation algorithm, extract the feature components with a time scale greater than the preset scale as steady-state dependent features, and extract the feature components with a time scale less than or equal to the preset scale as transient fluctuation features.

[0097] A pre-defined time-scale separation algorithm is used to decompose the fused hidden state matrix. This algorithm classifies the feature components in the fused hidden state matrix according to the size of their time scales. The pre-set scale is a predetermined time threshold used to distinguish between steady-state dependency features and transient fluctuation features. The feature components in the fused hidden state matrix are compared with the pre-set scale. Feature components with time scales larger than the pre-set scale are extracted; these feature components reflect the stable dependencies of the lock state over a longer period and are called steady-state dependency features. Feature components with time scales less than or equal to the pre-set scale are extracted; these feature components reflect the rapid changes and fluctuations of the lock state over a shorter period and are called transient fluctuation features. By extracting steady-state dependency features and transient fluctuation features, a deeper understanding of the changing patterns of the lock state can be achieved.

[0098] Step S144: Input the steady-state dependent features and transient fluctuation features into the attention mechanism layer of the anomaly discrimination model, calculate the attention weight values ​​of the features at different time steps, and perform weighted fusion of the features based on the attention weight values ​​to generate attention-enhanced feature vectors.

[0099] Step S1441: Align the steady-state dependency features and transient fluctuation features according to their feature dimensions.

[0100] Steady-state dependent features and transient fluctuation features may have different feature dimensions. To effectively fuse them, feature dimension alignment is necessary. Feature dimension alignment involves using methods to ensure that the number and order of feature dimensions are consistent between steady-state dependent features and transient fluctuation features. For example, feature expansion or pruning can be used to expand features with fewer dimensions to match the number of dimensions of features with more dimensions; or features with more dimensions can be pruned to match the number of dimensions of features with fewer dimensions. After feature dimension alignment, steady-state dependent features and transient fluctuation features are consistent in feature dimensions.

[0101] Step S1442: Construct a multi-head self-attention mechanism network and input the aligned steady-state dependency features and transient fluctuation features into different attention heads of the multi-head self-attention mechanism network.

[0102] Multi-head self-attention network is a core component in the attention mechanism layer of anomaly detection models. It consists of multiple attention heads, each of which can independently process the input features.

[0103] Aligned steady-state dependency features and transient fluctuation features are input into different attention heads of a multi-head self-attention mechanism network. Each attention head calculates an attention weight value based on the input features, reflecting the importance of features at different time steps. Through parallel processing of multiple attention heads, the relationships and importance between features can be captured from different angles and levels.

[0104] Step S1443: In each attention head, calculate the similarity matrix between steady-state dependent features and transient fluctuation features, and normalize the similarity matrix to obtain the basic attention weight matrix.

[0105] Within each attention head, the similarity matrix between steady-state dependent features and transient fluctuation features is first calculated. The similarity matrix reflects the degree of similarity between steady-state dependent features and transient fluctuation features across different time steps.

[0106] Next, the similarity matrix is ​​normalized. The purpose of normalization is to map the element values ​​in the similarity matrix to a suitable range so that they can serve as the basis for attention weights. Common normalization methods, such as the softmax function, can be used to convert the element values ​​in the similarity matrix into a probability distribution, resulting in the basic attention weight matrix. Each element in the basic attention weight matrix represents the relative importance of the feature at the corresponding time step.

[0107] Step S1444: Perform layer normalization on the basic attention weight matrix to eliminate the dimensional differences between different attention heads and generate a standardized attention weight matrix.

[0108] The basic attention weight matrices calculated by different attention heads may have different dimensions. In order to eliminate this difference, the basic attention weight matrices need to be normalized.

[0109] Layer normalization involves independently normalizing the base attention weight matrix for each attention head, making the numerical values ​​of the base attention weight matrices from different attention heads comparable. Through layer normalization, a standardized attention weight matrix is ​​generated. The standardized attention weight matrix more accurately reflects the importance of features at different time steps.

[0110] Step S1445: Perform matrix multiplication on the standardized attention weight matrix with the steady-state dependency feature and the transient fluctuation feature to obtain the weighted steady-state dependency feature and the weighted transient fluctuation feature.

[0111] The standardized attention weight matrix is ​​multiplied by both the steady-state dependency feature and the transient fluctuation feature. The matrix multiplication process involves multiplying each element of the standardized attention weight matrix by the corresponding element of the steady-state dependency feature and the transient fluctuation feature, resulting in the weighted steady-state dependency feature and the weighted transient fluctuation feature.

[0112] This weighting operation ensures that important features receive more attention during processing, while the influence of less important features is reduced. The weighted steady-state dependency features and weighted transient fluctuation features better reflect the differences in the importance of features at different time steps.

[0113] Step S1446: The weighted steady-state dependency features and the weighted transient fluctuation features are concatenated according to the feature dimension to generate an attention-enhanced feature vector containing temporal attention weights.

[0114] The weighted steady-state dependency features and the weighted transient fluctuation features are concatenated along the feature dimension. This concatenation process connects the weighted steady-state dependency features and the weighted transient fluctuation features along the feature dimension to form a new vector.

[0115] After concatenation, an attention-enhanced feature vector is generated, which includes temporal attention weights. This attention-enhanced feature vector integrates information from steady-state dependent features and transient fluctuation features, and highlights important features and time steps through an attention mechanism.

[0116] Step S145: Calculate the anomaly probability of the attention-enhanced feature vector through the fully connected output layer of the anomaly discrimination model to generate a lock state anomaly discrimination result containing anomaly type probability distribution and anomaly confidence.

[0117] The fully connected output layer of the anomaly detection model is the last layer of the model, and its main function is to calculate the anomaly probability of the input attention-enhanced feature vector.

[0118] The fully connected output layer uses the feature information from the attention-enhanced feature vectors to calculate the probability of various anomaly types through a series of calculations and processing. These anomaly probabilities constitute an anomaly type probability distribution. For example, anomaly types may include authorization verification anomalies, lock body malfunction anomalies, etc. The fully connected output layer calculates the likelihood of each anomaly type occurring.

[0119] Simultaneously, the fully connected output layer also calculates anomaly confidence. Anomaly confidence reflects the degree of credibility of the anomaly detection result and is determined based on the model's training and the characteristics of the input data.

[0120] After calculation, an anomaly judgment result of the lockout status is generated, which includes the probability distribution of the anomaly type and the anomaly confidence level. This judgment result can provide the managers of the target substation with detailed information about whether the lockout status is abnormal and the type of anomaly, so as to take appropriate measures in a timely manner.

[0121] Step S146: Analyze the probability distribution of abnormal types in the abnormal judgment result of the lock state, extract the abnormal type identifier with the highest probability and its corresponding abnormal confidence, query the preset abnormal handling knowledge base, and generate a causal inference knowledge graph containing abnormal cause analysis and handling suggestions.

[0122] Step S1461: Perform peak detection on the probability distribution of abnormal types in the abnormal judgment result of the lock state, and determine the abnormal type identifier with the highest probability value and its corresponding abnormal confidence level.

[0123] The anomaly type probability distribution in the lockout status anomaly detection results includes the occurrence probability of various anomaly types. To determine the most likely anomaly type, peak detection needs to be performed on the anomaly type probability distribution.

[0124] Peak detection involves comparing the probability values ​​in the anomaly type probability distribution and finding the highest probability value. The anomaly type corresponding to the highest probability value is identified as the most likely anomaly type. Simultaneously, the anomaly confidence level corresponding to this anomaly type is recorded; the anomaly confidence level reflects the reliability of the judgment regarding this anomaly type.

[0125] Step S1462: Based on the anomaly type identifier, query the preset anomaly handling knowledge base and extract the historical anomaly case set associated with the anomaly type. The historical anomaly case set includes the anomaly occurrence time, anomaly cause code, and handling measures record.

[0126] The pre-defined anomaly handling knowledge base is a database that stores information on various anomaly cases that have occurred in the target substation in the past. Based on the determined anomaly type identifier, a query is performed in the anomaly handling knowledge base to find the set of historical anomaly cases associated with that anomaly type.

[0127] The historical anomaly case collection contains detailed information on multiple historical anomaly cases. The anomaly occurrence time records the exact moment each anomaly case occurred; analyzing these times reveals patterns in anomaly occurrence. The anomaly cause code is a coded representation of the cause of the anomaly, accurately identifying its origin. The handling measures record details the methods and steps taken for each anomaly case.

[0128] Step S1463: Perform text semantic analysis on the historical abnormal case set to extract the standardized cause description text corresponding to the abnormal cause code and the key operation steps in the handling measure record.

[0129] The purpose of performing textual semantic analysis on a collection of historical anomaly cases is to extract useful information. First, for the anomaly cause codes, a pre-defined coding table is consulted to convert the anomaly cause codes into standardized cause description text. This standardized cause description text can more accurately express the reasons for the anomaly's occurrence.

[0130] Then, the records of handling measures are analyzed to extract the key operational steps. These key operational steps are the core steps in handling anomalies; by extracting them, effective handling methods and experiences can be summarized.

[0131] Step S1464: Construct a causal relationship network, with the anomaly type identifier as the root node, the standardized cause description text as the intermediate node, and the key operation steps as the leaf nodes. Establish directed association edges between nodes, and the weight of the directed association edges is determined based on the processing success rate of historical cases.

[0132] The purpose of constructing a causal relationship network is to visually demonstrate the relationship between anomaly types, anomaly causes, and handling measures. The anomaly type identifier is used as the root node, serving as the starting point of the entire network; standardized cause description text serves as intermediate nodes, connecting the root node and leaf nodes; and key operational steps serve as leaf nodes, located at the end of the network.

[0133] Directed edges are established between nodes, representing the causal relationship between anomaly type, anomaly cause, and handling measures. The weight of each directed edge is determined based on the success rate of handling historical cases. The higher the success rate, the greater the weight of the directed edge, indicating a more reliable causal relationship. In this way, the causal network can accurately demonstrate the possible causes and effective handling measures for different anomaly types.

[0134] Step S1465: Divide the causal relationship network into communities, identify the associated cause-measure node groups, and generate a causal derivation knowledge graph centered on the anomaly type, containing multi-level cause analysis and handling suggestions.

[0135] Community partitioning in causal networks aims to divide related nodes into different communities, each containing a set of associated cause-effect nodes. Community partitioning can employ community detection algorithms from graph theory, dividing the causal network into multiple relatively independent communities based on the connections and weights between nodes.

[0136] By dividing the community, we identify related cause-response node groups. Each cause-response node group contains an anomaly cause and its corresponding handling measure. Centered on the anomaly type, we organize and organize these cause-response node groups to generate a causal reasoning knowledge graph.

[0137] The causal reasoning knowledge graph includes multi-level cause analysis and handling suggestions. Starting with the type of anomaly, it progressively analyzes possible causes and provides corresponding handling recommendations. Through this knowledge graph, managers of the target substation can quickly understand the root cause of anomalies and take effective measures.

[0138] Step S147: Determine the warning level based on the anomaly confidence level, generate warning decision keywords by combining key processing suggestions in the causal inference knowledge graph, and encapsulate the causal inference knowledge graph and warning decision keywords into warning push information.

[0139] The warning level is determined based on the anomaly confidence level. A higher anomaly confidence level indicates a higher degree of confidence in the lock status, and the corresponding warning level is also higher. Different anomaly confidence level ranges and warning levels can be pre-defined, and the appropriate warning level can be found within this pre-defined range based on the current anomaly confidence level.

[0140] Early warning decision keywords are generated by combining key processing suggestions from the causal reasoning knowledge graph. Key processing suggestions are important handling measures proposed in the causal reasoning knowledge graph for anomalies. Representative and guiding keywords are extracted from these key processing suggestions, and these keywords can concisely express the core decisions for handling anomalies.

[0141] The causal reasoning knowledge graph and early warning decision keywords are encapsulated into early warning push messages. These messages contain detailed information about abnormal situations and handling suggestions, and can be sent to relevant management personnel through the target substation's information system so that they can promptly understand the abnormal situation and take appropriate measures.

[0142] As a non-limiting embodiment, the method further includes: step 210: collecting abnormal operation case data of historical interlocking terminals of the target substation, wherein the abnormal operation case data includes normal operation interaction data samples and abnormal operation interaction data samples, and each sample is labeled with a corresponding abnormal type label and abnormal level label.

[0143] During the long-term operation of the target substation, the interlocking terminals generate a large amount of operational interaction data, including both normal and abnormal operations. To construct an accurate anomaly detection model, it is necessary to collect historical abnormal operation case data from the interlocking terminals of the target substation.

[0144] These abnormal operation case data are divided into normal operation interaction data samples and abnormal operation interaction data samples. The normal operation interaction data samples record the operation information of the lock terminal under normal operating conditions, such as the time, type, and result of the operation; the abnormal operation interaction data samples record relevant information when the lock terminal performs abnormal operations.

[0145] To facilitate data analysis and model training, each sample is labeled with a corresponding anomaly type label and anomaly level label. The anomaly type label clarifies the specific type of the abnormal operation, such as an authorization verification anomaly or a lock malfunction anomaly; the anomaly level label classifies the anomaly according to its severity, such as mild anomaly, moderate anomaly, and severe anomaly. By labeling the samples, the model can better learn the characteristics of different types and levels of anomalies.

[0146] Step 220: Perform data augmentation processing on the normal operation interaction data samples and abnormal operation interaction data samples, and generate an expanded sample set through time series resampling and feature perturbation. The feature perturbation includes random fine-tuning of the operation time interval and operation type sequence.

[0147] To increase the diversity and quantity of training data and improve the generalization ability of the anomaly detection model, data augmentation processing is required for both normal operation interaction data samples and abnormal operation interaction data samples.

[0148] Data augmentation includes two aspects: time series resampling and feature perturbation. Time series resampling involves resampling the time series of data from operations and interactions, for example, by changing the sampling time interval to make the data distribution over time more diverse.

[0149] Feature perturbation involves randomly fine-tuning the features of the interactive data. Specifically, this includes randomly fine-tuning the operation time intervals and operation type sequences. Fine-tuning the operation time intervals, for example, by slightly increasing or decreasing the time interval between operations, simulates different operation rhythms; fine-tuning the operation type sequences, for example, by randomly changing the order of operation types or adding or deleting some operation types, makes the operation sequences more diverse.

[0150] An expanded sample set is generated through time-series resampling and feature perturbation. This expanded sample set contains more samples of different types and features, providing richer data resources for training the anomaly detection model.

[0151] Step 230: Divide the expanded sample set into a training set, a validation set, and a test set according to a preset ratio. Extract features from the sample data in the training set to generate a training feature vector containing operation sequence features, time interval features, and device association features.

[0152] The expanded sample set is divided into training, validation, and test sets according to a preset ratio. The preset ratio is determined based on actual model training needs and experience. For example, the expanded sample set can be divided into training, validation, and test sets at a ratio of 70%, 15%, and 15%, respectively.

[0153] The training set is used to train the anomaly detection model, allowing the model to learn the features and patterns in the sample data; the validation set is used to evaluate and adjust the model's performance during training, selecting the optimal model parameters; and the test set is used to evaluate the model's final performance after training is complete.

[0154] Feature extraction is performed on the sample data in the training set. Operation sequence features, time interval features, and equipment association features are extracted from the sample data in the training set. Operation sequence features reflect the order and combination of operations; time interval features record the time intervals between operations; and equipment association features reflect the relationship between the interlocking terminal and other equipment within the target substation.

[0155] These features are combined to generate a training feature vector. The training feature vector is the input data used to train the anomaly detection model. It contains key information from the sample data, enabling the model to better learn the characteristics of anomalous operations.

[0156] Step 240: Construct the network structure of the anomaly detection model. The network structure includes an input layer, a feature selection layer, a bidirectional long short-term memory network layer, an attention mechanism layer, and a fully connected output layer. The feature selection layer is implemented using the ReliefF algorithm, and the bidirectional long short-term memory network layer contains a preset number of hidden layer neurons.

[0157] The anomaly detection model's network structure consists of multiple layers, including an input layer, a feature selection layer, a bidirectional long short-term memory network layer, an attention mechanism layer, and a fully connected output layer.

[0158] The input layer is the entry point for the anomaly detection model, receiving training feature vectors as input data. The main function of the input layer is to perform preliminary processing and transformation of the input data, making it suitable for processing by subsequent layers.

[0159] The feature selection layer employs the ReliefF algorithm. ReliefF is a feature selection algorithm that calculates the weight coefficient of each feature based on its relevance and dissimilarity, selecting the most important features for anomaly detection. The feature selection layer uses the ReliefF algorithm to filter features from the input data, reducing data dimensionality and improving the model's training efficiency and accuracy.

[0160] Bidirectional Long Short-Term Memory (BSSM) networks are used to process time-series data and capture temporal dependencies within the data. A BSSM layer contains a predetermined number of hidden neurons, and the number of hidden neurons affects the model's learning and expressive abilities. Adjusting the number of hidden neurons can optimize the model's performance.

[0161] The attention mechanism layer is used to weight and fuse the features output by the bidirectional long short-term memory network layer, highlighting important features and time steps. This layer improves the model's sensitivity to anomalous features and enhances its discriminative ability.

[0162] The fully connected output layer is the last layer of the anomaly detection model. It calculates the anomaly probability based on the input features and outputs a detection result that includes the anomaly type probability distribution and anomaly confidence level.

[0163] Step 250: Initialize the network parameters of the anomaly detection model, input the training feature vector into the model for iterative training, and use the validation set to calculate the anomaly detection accuracy and F1 score of the model after each round of training. When the F1 score of the validation set converges for a consecutive preset number of rounds, stop the model training.

[0164] Initialize the network parameters of the anomaly detection model. Network parameters include the weights and biases of each layer, which are continuously adjusted and optimized during model training. There are several methods for initializing network parameters, such as random initialization or initialization using pre-trained parameters.

[0165] The training feature vectors are input into the anomaly detection model for iterative training. In each training round, the model calculates the output based on the input training feature vectors, compares it with the true labels of the samples, and calculates the loss function. Then, the network parameters are updated through backpropagation, causing the value of the loss function to continuously decrease.

[0166] After each training round, the anomaly detection accuracy and F1 score of the model are calculated using the validation set. Anomaly detection accuracy refers to the proportion of anomaly samples correctly identified by the model, reflecting the model's overall discrimination ability; the F1 score is an indicator that comprehensively considers the model's accuracy and recall, and can more comprehensively evaluate the model's performance.

[0167] When the F1 score on the validation set converges after a preset number of epochs, it indicates that the model's performance has stabilized, and training should be stopped. The preset number of epochs is a pre-defined number of epochs, such as 10 epochs. If the F1 score on the validation set changes very little over 10 consecutive epochs of training, it means the model has reached good performance, and stopping training at this point avoids overfitting.

[0168] Step 260: Evaluate the performance of the trained anomaly detection model using the test set. When the model's anomaly detection accuracy and F1 score both reach the preset evaluation metrics, save the model parameters as the final anomaly detection model. The test set is data that has not been used during model training, allowing for a more objective evaluation of the model's actual performance.

[0169] Input the sample data from the test set into the trained anomaly detection model, and calculate the model's anomaly detection accuracy and F1 score. The calculation methods for anomaly detection accuracy and F1 score are the same as those used in the validation set.

[0170] The preset evaluation indicators are pre-defined model performance standards, such as an anomaly detection accuracy of over 90% and an F1 score of over 0.8. When both the anomaly detection accuracy and F1 score of the model meet the preset evaluation indicators, it indicates that the model's performance meets the requirements, and the model parameters are saved as the final anomaly detection model. The final anomaly detection model can be used to detect anomalies in the real-time operation interaction data of the target substation's interlocking terminal.

[0171] Step 270: Collect new lock terminal operation interaction data according to the preset cycle, incrementally update the anomaly discrimination model, add the abnormal case samples in the new data to the training set, and retrain the fully connected output layer parameters of the model.

[0172] New operation interaction data from the lock control terminal is collected according to a preset cycle. The preset cycle is a time interval determined based on actual conditions, such as collecting new data weekly or monthly. As the target substation operates, the lock control terminal will continuously generate new operation interaction data, which may include new anomalies and operating modes.

[0173] Incremental updates are performed on the anomaly detection model. Incremental updates refer to updating only some parameters of the model without retraining the entire model to adapt to new data and situations. Anomaly case samples from the new data are added to the training set because these samples may contain new anomaly features; adding them to the training set allows the model to learn more anomaly patterns.

[0174] Retrain the parameters of the fully connected output layer of the model. The fully connected output layer is the last layer of the model and directly affects the model's output. By retraining the parameters of the fully connected output layer, the model can better adapt to new anomalies and improve the model's discrimination accuracy.

[0175] As another non-limiting embodiment, the method further includes: step 310: performing time series segmentation processing on the target operation interaction data, dividing the data into multiple consecutive time segments according to a preset time interval, each time segment containing operation interaction records of all lock terminals within that time period.

[0176] The target operation interaction data is a collection of operation information of the lock control terminal over a period of time. In order to achieve analysis and visualization, the target operation interaction data needs to be processed by time series segmentation.

[0177] The target interaction data is divided into multiple consecutive time segments according to a preset time interval. The preset time interval is determined based on the actual analysis needs and data characteristics; for example, the target interaction data can be divided into hourly or daily time intervals.

[0178] Each time segment contains operation interaction records of all lock control terminals within that time period. These operation interaction records include information such as the time, type, and result of the operation. Through time series segmentation processing, the target operation interaction data can be decomposed into multiple relatively independent time segments.

[0179] Step 320: Extract the operation frequency, operation success rate and number of abnormal operations of the lock terminal in each time segment, and generate a time-operation feature matrix. The rows of the time-operation feature matrix represent time segments, and the columns represent different operation feature dimensions.

[0180] Analysis of the operation interaction records within each time segment yielded three key operation characteristics: lock terminal operation frequency, operation success rate, and number of abnormal operations.

[0181] The operation frequency of the lock control terminal refers to the number of times the lock control terminal is operated within a certain time segment, reflecting the activity level of the lock control terminal; the operation success rate refers to the proportion of successful operations within a certain time segment to the total number of operations, reflecting the operational reliability of the lock control terminal; the number of abnormal operations refers to the number of abnormal operations that occur within a certain time segment, reflecting abnormal situations of the lock control terminal.

[0182] The operation frequency, success rate, and number of abnormal operations for each time segment are combined to generate a time-operation feature matrix. The rows of the time-operation feature matrix represent different time segments, and the columns represent different operation feature dimensions. This matrix provides a clear visual representation of the lock terminal's operation within each time segment.

[0183] Step 330: Construct a visualization canvas for lock status changes, set the time axis as the X-axis and the operation feature value as the Y-axis, and map the operation feature values ​​of different lock terminals to different layers of the canvas.

[0184] A visualization canvas for lock status changes is constructed. This canvas is a graphical interface used to display the operation status of the lock terminal. In the canvas, the time axis is set as the X-axis to represent the change over time; the operation characteristic values ​​are set as the Y-axis to represent the numerical values ​​of operation characteristics such as the operation frequency, operation success rate, and number of abnormal operations of the lock terminal.

[0185] The operational characteristic values ​​of different lock terminals are mapped to different layers of the canvas. Each lock terminal's operational characteristic value is represented by a different graphic or line on the canvas. By mapping them to different layers, the operational status of different lock terminals can be accurately distinguished. For example, different colored lines can be used to represent the curves of how the operational success rate of different lock terminals changes over time.

[0186] Step 340: Perform threshold judgment on the abnormal operation count feature in the time-operation feature matrix. When the abnormal operation count of the target time segment exceeds the preset threshold, generate an abnormal marker point at the corresponding time axis position. The size of the abnormal marker point is positively correlated with the abnormal operation count.

[0187] Threshold judgment is performed on the number of abnormal operations in the time-operation feature matrix. The preset threshold is a pre-defined limit on the number of abnormal operations, determined based on historical data and practical experience.

[0188] When the number of abnormal operations during a target time segment exceeds a preset threshold, it indicates a serious abnormality in the lock terminal within that time segment, requiring special attention. An anomaly marker is generated at the corresponding timeline position. This marker is a graphic mark on the visualization canvas used to highlight the time points when the number of abnormal operations exceeds the threshold.

[0189] The size of the anomaly marker is positively correlated with the number of abnormal operations; that is, the more abnormal operations, the larger the anomaly marker. The size of the anomaly marker provides a clear indication of the severity of the anomaly at different points in time.

[0190] Step 350: Plot the operation success rate of each lock terminal over time using a line graph. The curve color is dynamically adjusted according to the numerical range of the operation success rate to generate an operation success rate trend chart.

[0191] A line graph is used to plot the success rate of each lock terminal over time. In the visualization canvas, the success rate of each lock terminal in different time segments is connected with time as the X-axis and success rate as the Y-axis to form a line.

[0192] The curve color is dynamically adjusted based on the numerical range of the operation success rate. For example, when the operation success rate is high, the curve color can be set to green; when the operation success rate is low, the curve color can be set to red. This dynamic adjustment of the curve color visually displays the changes and trends in the operation success rate of each lock terminal.

[0193] The system generates an operation success rate trend chart, which helps managers quickly understand how the operational reliability of each lock terminal changes over time, promptly identify lock terminals with declining operation success rates, and take corresponding measures for maintenance and adjustment.

[0194] Step 360: Associate the anomaly type identifier in the lock state anomaly judgment result with the anomaly marker point. When the mouse hovers over the anomaly marker point, display the anomaly type, anomaly confidence level and summary information of the causal inference knowledge graph corresponding to the anomaly marker point.

[0195] The anomaly type identifier in the lock status anomaly determination result is associated with anomaly markers. During anomaly determination, the lock status anomaly determination result, which includes anomaly type identifiers, is already obtained. These anomaly type identifiers are then mapped to anomaly markers on the visualization canvas, ensuring that each anomaly marker is associated with an anomaly type identifier.

[0196] When the mouse hovers over an anomaly marker, a visualization canvas displays the anomaly type, anomaly confidence level, and a summary of the causal reasoning knowledge graph corresponding to that marker. The anomaly type clarifies the specific category of the anomaly, the anomaly confidence level reflects the reliability of the anomaly assessment, and the summary information of the causal reasoning knowledge graph provides possible causes and handling suggestions for the anomaly. Through this associative and interactive approach, managers can quickly understand the detailed anomaly information corresponding to each anomaly marker on the visualization canvas.

[0197] Step 370: Normalize the operation frequency characteristics of different lock control terminals to generate a heat map. The color depth of the heat map represents the operation frequency. The heat map can intuitively display the operation activity of each lock control terminal in different time periods.

[0198] The operation frequency characteristics of different lock control terminals are normalized. The operation frequency of different lock control terminals may have different value ranges. In order to display and compare them uniformly in the heatmap, it is necessary to normalize the operation frequency characteristics.

[0199] Normalization maps the values ​​of operating frequency characteristics to a set range, such as 0 to 1. By normalizing, the dimensional differences between the operating frequencies of different lock terminals can be eliminated, making them numerically comparable.

[0200] A heatmap is a visual representation of data values ​​using color. In a heatmap, the X-axis represents a time segment and the Y-axis represents the locking terminal. The color depth of each cell indicates the frequency of operation of that locking terminal within that time segment. Higher operation frequency results in a darker cell color; lower operation frequency results in a lighter cell color.

[0201] Heatmaps provide a clear visual representation of the operational activity of each lock terminal across different time periods. Administrators can quickly identify which lock terminals are most frequently used during which time periods, allowing for more efficient resource allocation and management.

[0202] Step 380: Overlay the success rate trend chart, anomaly markers, and heatmap to generate a visualization interface of lock status changes containing multi-dimensional information.

[0203] The success rate trend chart, anomaly markers, and heatmap are overlaid as layers. On the visualization canvas, the success rate trend chart, anomaly markers, and heatmap are overlaid in a specific order so that they are displayed in the same graphical interface.

[0204] The operation success rate trend chart shows how the operation success rate of each lock terminal changes over time; the anomaly markers highlight the time points when the number of abnormal operations exceeds the threshold and the abnormal situations; the heat map intuitively shows the operation activity of each lock terminal in different time periods.

[0205] By overlaying layers, a visualization interface for the lock control status changes containing multi-dimensional information is generated. This visualization interface can simultaneously display information such as the success rate of lock control terminal operations, abnormal situations, and operational activity, providing managers with a comprehensive and intuitive platform to display the operational status of lock control terminals, making it easier for them to promptly identify, analyze, and resolve problems.

[0206] Please see Figure 2 The figure is a schematic diagram of the basic structure of a lock control terminal data analysis system 200 provided in an embodiment of this application. The lock control terminal data analysis system 200 includes: a processor 201; a storage device 202 on which a computer program 2020 is stored; and a network interface 203 for providing network communication functions. When the computer program 2020 is executed by the processor 201, the processor 201 implements any of the lock control terminal data analysis methods applied to intelligent management of substations.

[0207] Please see Figure 3 This application provides a functional block diagram of a lock control terminal data analysis device for intelligent substation management. The lock control terminal data analysis device includes: a data acquisition module, used to collect historical operation interaction data generated by each lock control terminal in the target substation through a current distributed acquisition node; and a node adjustment module, used to adjust the weights of the current distributed acquisition nodes corresponding to each lock control terminal according to the current status label of each lock control terminal to obtain a target distributed acquisition node and collect the current operation interaction data generated by each lock control terminal, and determine the target operation based on the historical operation interaction data and the current operation interaction data. The system includes: an interaction data module; a feature extraction module, used to combine the operating rules and locking logic of the target substation and use a deep reinforcement learning algorithm to extract features from the target operation interaction data to obtain locking interaction features; wherein, the feature extraction strategy of the deep reinforcement learning algorithm is adaptively adjusted according to the interaction environment between the target substation and the locking terminal; and an anomaly detection module, used to input the locking interaction features into an anomaly detection model to obtain an anomaly detection result for the locking state, and generate early warning push information for the target substation based on the anomaly detection result for the locking state; wherein, the early warning push information includes a causal inference knowledge graph of the anomaly detection result for the locking state and early warning decision keywords.

[0208] Based on the above, a readable storage medium is provided, on which a program or instructions are stored, and when the program or instructions are executed by a processor, the steps of the above method are implemented.

[0209] Please refer to the following: Figure 1 and Figure 4 This application improves the efficiency and accuracy of data analysis for lock control terminals in intelligent substation management, thereby enhancing the overall safety and reliability of the substation. First, historical operation interaction data of each lock control terminal in the target substation is collected by the current distributed acquisition node. Based on this, the weights of the current distributed acquisition node are adjusted according to the current status label of each lock control terminal to obtain the target distributed acquisition node, which then collects the current operation interaction data. Finally, the target operation interaction data is determined. This adaptive weight adjustment mechanism makes data collection more accurate and efficient, enabling real-time capture of dynamic changes in the lock control terminal and comprehensively and accurately reflecting its operating status.

[0210] Then, combining the operating rules and interlocking logic of the target substation, a deep reinforcement learning algorithm is used to process the target operation interaction data. The feature extraction strategy of this algorithm can be adaptively adjusted according to the interaction environment between the target substation and the interlocking terminal. It can deeply mine the hidden features in the data that are closely related to interlocking safety. The adaptive feature extraction method breaks the limitations of the fixed strategy of traditional methods, can better adapt to the complex and ever-changing substation environment, and improve the sensitivity and identification ability of abnormal situations.

[0211] Finally, the extracted lock control interaction features are input into the anomaly detection model to obtain the anomaly detection results for the lock control status. Based on this, early warning push information containing a causal inference knowledge graph and early warning decision keywords is generated. The anomaly detection model integrates multimodal information, comprehensively considering the time series information, spatial location information, and operational context information of the lock control operation, constructing a multidimensional anomaly detection model that can accurately identify abnormal changes in the lock control status. The early warning push mechanism based on knowledge graphs and natural language processing transforms abnormal information into intuitive knowledge graphs and early warning information with decision-making guidance significance, and provides personalized pushes according to different management roles and responsibilities, improving the accuracy and response speed of substation management decisions.

[0212] Overall, this application's embodiments achieve comprehensive, real-time, and accurate monitoring of the substation interlocking terminal's operational status by constructing an adaptive data acquisition architecture, intelligent feature extraction algorithms, precise anomaly identification models, and efficient early warning push mechanisms. This not only enables timely detection of potential anomalies and reduces the likelihood of potential faults, but also provides managers with accurate and reliable decision-making support, optimizes system reliability and maintenance efficiency, and enhances the overall safety monitoring capabilities of the substation.

[0213] Furthermore, it should be noted that this application also provides a computer program product, which may include a computer program that can be stored in a computer-readable storage medium. The processor of the lock control terminal data analysis system reads the computer program from the computer-readable storage medium, and the processor can execute the computer program, causing the lock control terminal data analysis system to perform the aforementioned... Figure 1 The methods described in the corresponding embodiments are already known, and therefore will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the computer program product embodiments related to this application, please refer to the description of the method embodiments of this application.

[0214] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems or apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and relevant parts can be referred to the method section.

Claims

1. A data analysis method for lock control terminals applied to intelligent management of substations, characterized in that, The method includes: collecting historical operation interaction data generated by each lock control terminal of the target substation through current distributed acquisition nodes; each current distributed acquisition node is responsible for collecting the historical operation interaction data generated by the corresponding lock control terminal; adjusting the weight of the current distributed acquisition nodes corresponding to each lock control terminal according to the current status label of each lock control terminal to obtain the target distributed acquisition node and collecting the current operation interaction data generated by each lock control terminal; determining the target operation interaction data according to the historical operation interaction data and the current operation interaction data, including: parsing the current status label of each lock control terminal, extracting the status feature index characterizing the operational stability of the lock control terminal, constructing an acquisition node weight evaluation function according to the status feature index; inputting the historical data acquisition accuracy and data transmission delay parameter of the current distributed acquisition node after eliminating the difference in dimensions into the node weight evaluation function to calculate the dynamic weight value of each current distributed acquisition node; prioritizing the current distributed acquisition nodes based on the dynamic weight value, and selecting a preset number of distributed acquisition nodes with the highest weight value as the target distributed acquisition node. The system involves collecting data from each lock control terminal within a preset time window using distributed acquisition nodes. This data includes an operation execution time sequence, operation type identifier, and operation result status code. The system performs timeline calibration on the historical and current operation interaction data, replacing overlapping portions with the current data to generate target operation interaction data containing a complete time sequence. Combining the target substation's operating rules and lock control logic, a deep reinforcement learning algorithm is used to extract features from the target operation interaction data, resulting in lock control interaction features. The feature extraction strategy of the deep reinforcement learning algorithm is adaptively adjusted based on the interaction environment between the target substation and the lock control terminal. The lock control interaction features are input into an anomaly detection model to obtain anomaly detection results. Based on these results, early warning push information for the target substation is generated. This early warning push information includes a causal derivation knowledge graph of the lock control anomaly detection results and early warning decision keywords.

2. The method as described in claim 1, characterized in that, The step of combining the operating rules and interlocking logic of the target substation and using a deep reinforcement learning algorithm to extract features from the target operation interaction data to obtain interlocking interaction features includes: inputting the target operation interaction data into the experience replay pool of the deep reinforcement learning algorithm; generating an initial state space by combining the operating rules of the target substation, wherein the initial state space contains the operation sequence features of the interlocking terminal and the substation equipment association features; calling the policy mapping branch of the deep reinforcement learning algorithm to perform feature mapping processing on the initial state space, generating a policy function containing the probability distribution of operation intentions, wherein the number of neurons in the output layer of the policy function is consistent with the number of interlocking operation types; and constructing based on the interlocking logic. A reward function is constructed, which calculates an immediate reward value based on the degree of compliance between the operation execution result and the substation safety rules; the higher the compliance, the larger the immediate reward value. A state value function is generated by evaluating the probability distribution of the operation intent output by the policy function through a state value evaluation branch of a deep reinforcement learning algorithm. This state value function is used to predict the cumulative reward value of the current operation sequence within a future time window. The parameter weights of the policy mapping branch are updated based on the immediate reward value and the state value function. Through multiple iterations of training, the policy function converges to the optimal feature extraction policy. The converged policy mapping branch is then used to extract features from the target operation interaction data to obtain the lock control interaction features.

3. The method as described in claim 2, characterized in that, The step of constructing a reward function based on the locking logic, wherein the reward function calculates an immediate reward value based on the degree of conformity between the operation execution result and the substation safety rules, includes: parsing the operation permission matrix in the locking logic, extracting the allowed operation set and prohibited operation set corresponding to different user roles, and constructing an operation permission verification rule base; performing permission matching processing on the operation type identifier in the target operation interaction data, determining whether the current operation belongs to the allowed operation set, and generating a permission verification result; querying the substation safety rule base according to the permission verification result, extracting the safety constraints associated with the current operation, wherein the safety constraints include the preconditions and post-state requirements for operation execution; comparing the operation result status code with the post-state requirements in the safety constraints, calculating the state conformity parameter, wherein the state conformity parameter is the ratio of the number of successfully matched state items in the post-state requirements to the total number of state items; constructing a reward function based on the permission verification result and the state conformity parameter, wherein when the permission verification result is allowed and the state conformity parameter is greater than a preset conformity, the reward function outputs a positive immediate reward value, otherwise it outputs a negative immediate reward value, and the absolute value of the negative immediate reward value is negatively correlated with the state conformity parameter.

4. The method as described in claim 3, characterized in that, The step of updating the parameter weights of the policy mapping branch based on the immediate reward value and the state value function, and converging the policy function to the optimal feature extraction policy through multiple iterations of training, includes: randomly sampling a preset batch of target operation interaction data samples from the experience replay pool of the deep reinforcement learning algorithm to construct a training sample set; inputting the training sample set into the policy mapping branch to generate the operation policy distribution and state value estimate corresponding to each sample; calculating the temporal difference error based on the immediate reward value and the state value estimate, wherein the temporal difference error is the difference between the weighted sum of the immediate reward value and the state value estimate and the next state value estimate; backpropagating the temporal difference error to each layer of neurons in the policy mapping branch using the gradient descent algorithm to update the connection weight parameters of the neurons; calculating the KL divergence value of the policy function after each preset number of parameter updates, and determining that the policy function has converged to the optimal feature extraction policy when the KL divergence value is less than a preset convergence value for multiple consecutive iterations, and stopping the parameter update process.

5. The method as described in claim 1, characterized in that, The step of inputting the lock control interaction features into an anomaly detection model to obtain an anomaly detection result for the lock control state, and generating early warning push information for the target substation based on the anomaly detection result for the lock control state, includes: performing dimensionality standardization processing on the lock control interaction features, mapping feature values ​​to a preset numerical range, and generating a standardized lock control interaction feature vector; inputting the standardized lock control interaction feature vector into the feature selection layer of the anomaly detection model to calculate the weight coefficient of each feature dimension, retaining feature dimensions with weight coefficients greater than preset coefficients, and generating dimensionality-reduced key lock control interaction features; calling the bidirectional long short-term memory network layer of the anomaly detection model to model the temporal dependency relationship of the key lock control interaction features, and extracting steady-state dependency features and transient fluctuation features; inputting the steady-state dependency features and transient fluctuation features into the attention machine of the anomaly detection model. The system calculates attention weights for features at different time steps, and then weights and fuses these features based on these attention weights to generate an attention-enhanced feature vector. The fully connected output layer of the anomaly detection model calculates the anomaly probability of this attention-enhanced feature vector, generating a lock-state anomaly detection result containing anomaly type probability distributions and anomaly confidence levels. The system analyzes the anomaly type probability distributions in the lock-state anomaly detection result, extracts the anomaly type identifier with the highest probability and its corresponding anomaly confidence level, queries a pre-defined anomaly handling knowledge base, and generates a causal inference knowledge graph containing anomaly cause analysis and handling suggestions. Based on the anomaly confidence level, the system determines the warning level, combines key handling suggestions from the causal inference knowledge graph to generate warning decision keywords, and encapsulates the causal inference knowledge graph and warning decision keywords into a warning push message.

6. The method as described in claim 5, characterized in that, The bidirectional long short-term memory network layer of the anomaly detection model models the temporal dependencies of the key locking interaction features, extracting steady-state dependency features and transient fluctuation features. This includes: arranging the key locking interaction features in chronological order into a feature sequence; dividing the feature sequence into multiple time window sub-sequences; inputting each time window sub-sequence into the forward propagation unit of the bidirectional long short-term memory network layer to calculate a forward hidden state sequence, which contains feature dependencies from the beginning of the sequence to the current position; inputting each time window sub-sequence in reverse order into the backward propagation unit of the bidirectional long short-term memory network layer to calculate a reverse hidden state sequence, which contains feature dependencies from the end of the sequence to the current position; performing positional concatenation of the forward and reverse hidden state sequences to generate a fused hidden state matrix containing bidirectional dependency information; and decomposing the fused hidden state matrix using a preset time scale separation algorithm, extracting feature components with time scales greater than a preset scale as steady-state dependency features, and extracting feature components with time scales less than or equal to the preset scale as transient fluctuation features.

7. The method as described in claim 6, characterized in that, The process of inputting the steady-state dependency features and transient fluctuation features into the attention mechanism layer of the anomaly detection model, calculating the attention weight values ​​of features at different time steps, and weighting and fusing the features based on the attention weight values ​​to generate an attention-enhanced feature vector includes: aligning the steady-state dependency features and transient fluctuation features according to their feature dimensions; constructing a multi-head self-attention mechanism network and inputting the aligned steady-state dependency features and transient fluctuation features into different attention heads of the multi-head self-attention mechanism network; calculating the similarity matrix between the steady-state dependency features and transient fluctuation features in each attention head, normalizing the similarity matrix to obtain a basic attention weight matrix; performing layer normalization on the basic attention weight matrix to eliminate the dimensional differences between different attention heads and generating a standardized attention weight matrix; performing matrix multiplication operations on the standardized attention weight matrix with the steady-state dependency features and transient fluctuation features to obtain weighted steady-state dependency features and weighted transient fluctuation features; and concatenating the weighted steady-state dependency features and weighted transient fluctuation features according to their feature dimensions to generate an attention-enhanced feature vector containing temporal attention weights.

8. The method as described in claim 5, characterized in that, The process of analyzing the probability distribution of abnormal types in the lock status anomaly detection results, extracting the anomaly type identifier with the highest probability and its corresponding anomaly confidence, querying a preset anomaly handling knowledge base, and generating a causal derivation knowledge graph containing anomaly cause analysis and handling suggestions includes: performing peak detection on the probability distribution of abnormal types in the lock status anomaly detection results to determine the anomaly type identifier with the highest probability value and its corresponding anomaly confidence; querying the preset anomaly handling knowledge base based on the anomaly type identifier to extract a set of historical anomaly cases associated with the anomaly type, wherein the set of historical anomaly cases includes the anomaly occurrence time, anomaly cause code, etc. The system records codes and handling measures; it performs text semantic analysis on the historical anomaly case set to extract standardized cause description text corresponding to the anomaly cause codes and key operation steps from the handling measure records; it constructs a causal relationship network with anomaly type identifier as the root node, standardized cause description text as intermediate nodes, and key operation steps as leaf nodes, establishing directed association edges between nodes, the weight of which is determined based on the handling success rate of historical cases; it performs community division on the causal relationship network, identifies associated cause-measure node groups, and generates a causal derivation knowledge graph centered on anomaly type, containing multi-level cause analysis and handling suggestions.

9. A lock control terminal data analysis system, characterized in that, include: processor; A storage device storing a computer program; a network interface for providing network communication functions; when the computer program is executed by the processor, the processor implements the data analysis method for lock control terminals applied to intelligent management of substations as described in any one of claims 1-8.

Images