Electric power marketing metering equipment abnormity early warning method and system based on edge calculation

Abstract

The invention discloses an electric power marketing metering equipment abnormity early warning method and system based on edge computing, and relates to the technical field of electric power system monitoring, and the method comprises the steps: collecting the original multi-mode operation data flow of target electric power marketing metering equipment in real time during the operation of the system; performing sliding window segmentation and parallel feature extraction on the data stream to obtain a mixed feature vector; inputting the mixed feature vector into an isolated forest model and a gradient boosting decision tree model in an integrated anomaly detection engine, and calculating a comprehensive anomaly confidence score; generating a local early warning event or cache feature data according to the confidence score, and triggering an adaptive communication scheduling process; on the collaborative decision-making platform side, receiving and aggregating reported information, carrying out Bayesian network reasoning by combining the multi-source data of the power grid, and completing global anomaly verification and final decision-making; and starting a model evolution process according to a global verification result, executing incremental learning and generating a parameter updating package.

Description

Technical Field

[0001] This invention relates to the field of power system monitoring technology, specifically to a method and system for early warning of anomalies in power marketing metering equipment based on edge computing. Background Technology

[0002] With the rapid development of smart grids and the Internet of Things (IoT) in the power sector, electricity marketing metering equipment, as a key node connecting the power supply side and the user side, directly impacts the accuracy of electricity billing, the effectiveness of electricity consumption behavior analysis, and the safety of power grid operation. Currently, the power marketing system is widely deployed with a large number of smart meters, data acquisition terminals, and other metering devices, placing higher demands on their real-time status monitoring and anomaly early warning. Traditional methods for detecting anomalies in metering equipment mainly rely on centralized master station systems for periodic data collection and rule comparison, which suffers from high response latency, heavy communication load, and idle edge computing power, making it difficult to meet the demands of modern power marketing operations requiring high concurrency, low latency, and high reliability.

[0003] Existing technologies still have significant shortcomings in this field: First, edge data processing models generally use fixed thresholds or simple statistical rules, lacking the ability to model complex nonlinear anomaly patterns, resulting in high false alarm and false negative rates; second, there is a lack of collaborative optimization mechanisms between edge nodes and cloud platforms, making it impossible to dynamically adjust reporting strategies based on network status, device importance, and anomaly confidence, leading to wasted communication resources or loss of critical alarms; third, existing solutions mostly focus on single-type anomaly detection, failing to build a unified multi-scenario anomaly feature library and a scalable early warning framework, making it difficult to adapt to the differentiated needs of different regions and user types; finally, edge algorithm updates and model iterations are highly dependent on manual intervention, lacking online learning and self-evolution capabilities, and their performance is prone to degradation in long-term operation. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method and system for early warning of anomalies in electricity marketing metering equipment based on edge computing, which solves the problems mentioned in the background technology.

[0005] To achieve the above objectives, this invention employs the following technical solutions: An edge computing-based early warning system for power marketing metering equipment anomalies, comprising an edge computing unit deployed on the power marketing metering equipment side, used to collect the raw operating data stream of the metering equipment in real time, and perform data preprocessing, feature extraction, and preliminary anomaly detection locally, generating local anomaly early warning events with confidence scores; a model management platform deployed at a regional aggregation node or in the cloud, used to receive and aggregate early warning events and feature data from multiple edge computing units, perform global anomaly verification, multi-source information fusion, and early warning decision-making, and responsible for generating and distributing incremental learning parameter packages for edge-side model updates; an adaptive communication scheduling module connecting the edge computing unit and the collaborative decision-making platform, used to dynamically adjust the reporting strategy and transmission priority of early warning events and feature data based on network bandwidth status, equipment importance level, and the confidence level of the early warning event; and a multi-scenario anomaly feature library and model repository stored in the collaborative decision-making platform, used to store standardized feature vectors and corresponding detection model baseline versions for different regions, user types, and anomaly patterns, providing support for the initialization and differentiated deployment of edge-side models.

[0006] Preferably, the edge computing unit includes a data acquisition interface, a lightweight time-series feature extraction module, an integrated anomaly detection engine, and a local event generator. The data acquisition interface periodically or event-triggeredly acquires multi-dimensional raw data streams such as voltage, current, power, energy readings, event records, and device status words from smart meters and data acquisition terminals. The lightweight time-series feature extraction module uses a sliding window mechanism to segment the raw data stream and calculates statistical features, frequency domain features, and time-series dependency features for each window of data. Statistical features include mean, variance, skewness, kurtosis, and the rate of change within a preset time interval. Frequency domain features are extracted using Fast Fourier Transform to obtain the main frequency components and their energy proportions. Time-series dependency features are obtained by calculating the autocorrelation coefficient or extracting hidden state vectors using a gated recurrent unit network. The integrated anomaly detection engine runs at least two heterogeneous detection models in parallel, including an unsupervised model based on an isolated forest for detecting unknown pattern anomalies and a supervised model based on a gradient boosting decision tree for identifying known types of anomalies. The outputs of the two models are fused using a weighted voting mechanism, with the weights dynamically adjusted based on the model's F1 score on the historical validation set. The local event generator receives the anomaly label and confidence score output by the integrated anomaly detection engine. When the confidence score exceeds the first preset threshold, it immediately generates a local warning event containing the device identifier, timestamp, anomaly type, confidence score, and key feature vector. For suspicious events with confidence scores between the first and second preset thresholds, it only extracts and caches their feature vectors, waiting for subsequent instructions.

[0007] Preferably, the model management platform includes a global event aggregator, a multi-source information fusion decision module, and a model evolution management module. The global event aggregator receives early warning events and feature data reported by multiple edge computing units, performs cluster analysis according to the device's region, distribution area, and time window, and identifies whether there are spatially or temporally correlated abnormal patterns. The multi-source information fusion decision module performs correlation analysis between the abnormal features reported by the edge computing units and the same-period meteorological data, power grid operation data, and user historical electricity consumption records stored on the platform side; by constructing a Bayesian network, it calculates the posterior probability that the anomaly is a real fault under given multi-source evidence, using this as the final confidence level for global verification. The model evolution management module continuously monitors the detection performance indicators and feature data distribution changes reported by all edge computing units; when a significant drift in the feature distribution of a certain type of anomaly is detected, or the average false alarm rate of edge nodes in a certain area continuously exceeds a set threshold, the model update process is triggered; this module retrieves the corresponding baseline model from the model repository, uses newly collected high-confidence abnormal samples and normal samples, performs incremental training in the cloud, and generates a model parameter difference file, i.e., an incremental learning parameter package.

[0008] Preferably, the adaptive communication scheduling module incorporates a bandwidth sensor, a policy rule base, and a data compression encoder. The bandwidth sensor monitors the network round-trip latency and available bandwidth from the edge node to the cloud platform in real time. The policy rule base defines reporting strategies under different combinations of conditions: when network bandwidth is sufficient and the confidence level of the warning event is higher than a preset high threshold, a complete event data reporting mode is adopted; when network bandwidth is limited, only the event summary and the dimensionality-reduced projection of the high-dimensional feature vector are reported; for suspicious events with a confidence level lower than the threshold but high feature novelty, a delayed batch reporting mode is adopted. The data compression encoder performs lossy compression using principal component analysis or lossless compression using dictionary encoding on the feature vectors to be reported, thereby reducing the communication load.

[0009] Feature novelty is obtained by calculating the distance between the current event feature vector and the center of the normal feature cluster in the multi-scene abnormal feature library. When the distance exceeds the 95th percentile of historical normal samples, the feature novelty is considered high. Deviation is calculated using the same distance metric and normalized by the maximum and minimum as one of the input factors for calculating the above event importance index.

[0010] Preferably, the multi-scenario anomaly feature library is divided into equipment failure, electricity theft, metering error, and environmental impact categories according to the root causes of the anomalies. Each category stores standard feature templates abstracted from expert experience and historical cases, as well as a similarity calculation function for matching the template. The model repository maintains a corresponding lightweight detection model baseline for each anomaly template category. This baseline model is pre-trained in the cloud using large-scale historical data, and its structure and parameters are pruned and quantized to adapt to the limited computing resources on the edge.

[0011] Preferably, the model management platform further includes a cross-regional anomaly pattern migration analysis module, used to identify the migration patterns of anomaly patterns between different regions. Specifically, this includes: constructing an anomaly pattern transfer matrix based on the time series of historical anomaly events from different regions; identifying anomaly pattern chains that may propagate across regions based on graph clustering algorithms; and when an anomaly pattern is detected to have a cross-regional diffusion trend, issuing a rapid enhancement model or anomaly feature fragment to the edge units of the affected region in advance to improve the early identification capability of anomalies in that region, thereby realizing cross-regional anomaly linkage early warning and proactive adaptation of the model.

[0012] Preferably, the temporal dependency feature extraction in step S120 is implemented using a lightweight gated recurrent unit network, and its hidden state update formula is:

[0013] ;

[0014] ;

[0015] ;

[0016] ; where x t Let h be the input feature at time t. t−1 The hidden state of the previous moment, z t r t These are the update door and the reset door, respectively. z W r W is the trainable parameter matrix, σ is the sigmoid function, and ⊙ represents element-wise multiplication; the hidden state h at the last time step... t As a feature vector representing the temporal dependencies of the entire window.

[0017] Preferably, the weighted fusion strategy in step S140 is as follows: Let the anomaly score output by the isolated forest model be s. if The gradient boosting decision tree model predicts the probability of the "anomaly" category as p. gbt Given the preset fusion weights α and (1−α), the comprehensive anomaly confidence score C is calculated as follows: The weight α is dynamically adjusted based on the difference in F1-score between the two models in the most recent evaluation period, with the adjustment range limited to the interval [0.3, 0.7].

[0018] The model update process triggered by the model evolution management module includes: loading the baseline model Mbase of the target anomaly type from the model repository;

[0019] Collect a set D of high-confidence positive and negative samples that has been globally validated since the last update. new ;

[0020] Utilizing D in the cloud new For M base Perform incremental training for a fixed number of rounds, updating only the parameters of the last few layers of the model to obtain a new model M. new ;

[0021] Calculate M new With M base The difference ΔW between the corresponding layer parameters is used; ΔW is then sparsified and quantized to generate an incremental learning parameter package.

[0022] Preferably, the adaptive communication scheduling module further includes an event importance dynamic evaluator, which calculates the event importance index Ie based on the following conditions: the criticality level of the equipment in the regional power grid topology; the power grid load fluctuation rate corresponding to the period of the anomaly; the confidence interval offset of the edge-side detection model within the recent window; and the deviation of the anomaly feature vector from the nearest neighbor feature cluster in the feature library.

[0023] When the event importance index Ie exceeds the set importance threshold, even if network bandwidth is limited, the priority jump mechanism is forcibly triggered, so that the event is sent to the collaborative decision-making platform with the highest priority channel.

[0024] In its implementation, the event importance index Ie is obtained by normalizing the four factors mentioned above and combining them according to a preset rule. Equipment criticality levels are divided into 1 to 5 levels based on their location in the power grid topology and linearly mapped to the [0,1] interval. Power grid load volatility is obtained by calculating the ratio of the difference between the average active power within 15 minutes before and after the anomaly to the long-term average, and then truncated to the [0,1] interval. Confidence interval offset is obtained by comparing the confidence interval of the probability distribution output by the edge detection model within the recent window with the confidence interval of the historical baseline. Feature deviation is obtained by calculating the Euclidean distance between the abnormal feature vector and the nearest neighbor feature cluster center in the feature library and then performing max-min normalization. The system combines the four normalized factors according to a preset rule and limits the result to the [0,1] interval, which is used as the event importance index Ie.

[0025] An abnormal early warning method for electricity marketing metering equipment based on edge computing includes the following steps:

[0026] Step S110: On the edge computing unit side, collect the raw multimodal operation data stream of the target power marketing metering equipment in real time;

[0027] Step S120: Perform sliding window segmentation and parallel feature extraction on the original running data stream to obtain a hybrid feature vector containing statistical features, frequency domain features, and time-series dependent features;

[0028] Step S130: The hybrid feature vector is simultaneously input into the isolated forest model and the gradient boosting decision tree model in the integrated anomaly detection engine to obtain the unsupervised anomaly score and the supervised classification probability, respectively.

[0029] Step S140: Based on the preset fusion weights, the unsupervised anomaly score and the supervised classification probability are weighted and fused to calculate the comprehensive anomaly confidence score of the current data window.

[0030] Step S150: Based on the comparison result between the comprehensive anomaly confidence score and the preset threshold, decide to generate a local early warning event or cache feature data, and trigger the adaptive communication scheduling process.

[0031] Step S160: On the collaborative decision-making platform side, receive and aggregate reported information from multiple edge nodes, combine multi-source data of the power grid to perform Bayesian network inference, and complete global anomaly verification and final decision.

[0032] Step S170: Based on the global validation results and continuously monitored performance metrics, determine whether it is necessary to start the model evolution process. If so, perform incremental learning and generate a parameter update package.

[0033] Step S180: The parameter update package is sent to the relevant edge computing unit, and the edge unit performs a hot update on the local model after receiving it.

[0034] This invention provides a method and system for early warning of anomalies in electricity marketing metering equipment based on edge computing, which has the following beneficial effects:

[0035] (1) During system operation, the system collects the original multimodal operation data stream of the target power marketing metering equipment in real time; performs sliding window segmentation and parallel feature extraction on the data stream to obtain a hybrid feature vector; inputs the hybrid feature vector into the isolated forest model and gradient boosting decision tree model in the integrated anomaly detection engine to calculate the comprehensive anomaly confidence score; generates local early warning events or cached feature data based on the confidence score and triggers the adaptive communication scheduling process; on the collaborative decision-making platform side, it receives and aggregates the reported information, performs Bayesian network inference in combination with multi-source data of the power grid, and completes global anomaly verification and final decision; and starts the model evolution process based on the global verification results, performs incremental learning and generates parameter update packages. The system includes an edge computing unit deployed on the power marketing metering equipment side, a collaborative decision-making and model management platform deployed on the regional aggregation node or cloud, an adaptive communication scheduling module connecting the edge computing unit and the collaborative decision-making platform, and a multi-scenario anomaly feature library and model warehouse stored in the collaborative decision-making platform.

[0036] (2) By constructing a three-tiered collaborative architecture consisting of edge computing units, edge collaborative gateways, and a central analysis platform, the system achieves reasonable decentralization of anomaly detection computing power and centralized optimization of global intelligence, significantly reducing cloud communication load and processing latency, and improving the real-time response of the system. A unified multi-scenario anomaly feature library and an extensible early warning framework have been established. Through a mechanism combining federated learning and incremental learning, the system achieves online continuous optimization and self-evolution of the edge detection model, improving its adaptability to the differentiated needs of different regions and user types, as well as its long-term operational stability.

[0037] (3) By using a collaborative decision-making platform to perform global aggregation analysis of abnormal events from multiple edge nodes, and combining multi-source data such as meteorological, power grid operating conditions, and user profiles for Bayesian inference, the system achieves cross-domain intelligent fusion capability from local anomaly to global anomaly pattern recognition. The model evolution management mechanism enables the system to adaptively update based on data distribution drift and model performance changes, ensuring the stability and accuracy of the detection model during long-term operation. The introduction of the cross-regional anomaly pattern migration analysis module enables the system to have regional linkage early warning capability, effectively improving the ability to identify the spread trend of large-scale anomalies in advance.

[0038] (4) Compared with existing technologies, this system not only achieves deep integration of edge intelligence and cloud collaboration, but also significantly improves the timeliness, accuracy, and global consistency of anomaly detection through a multi-level adaptive mechanism. In typical marketing scenarios with limited bandwidth, wide distribution of power equipment, and complex and ever-changing anomaly patterns, this invention can effectively reduce false alarm and false negative rates, improve the long-term adaptability of the model, enhance the operational security and management efficiency of the power metering system, and ultimately achieve a comprehensive improvement in the ability to accurately warn and proactively prevent and control equipment anomalies. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of the overall technical solution architecture of the power marketing metering equipment anomaly early warning method based on edge computing proposed in this invention;

[0040] Figure 2 This is a schematic diagram of the core principle framework of the integrated anomaly detection engine in this invention;

[0041] Figure 3 This is a schematic diagram of the multi-level interaction relationship and data flow between the edge computing unit and the collaborative decision-making platform in this invention; Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0043] Example 1

[0044] This invention provides an early warning system for abnormal electricity marketing metering equipment based on edge computing. Please refer to [link / reference]. Figure 1 It includes an edge-side anomaly early warning and processing module, a model management module, an adaptive communication scheduling module, and a warehouse storage module;

[0045] The edge-side anomaly warning and processing module is deployed on the edge computing unit of the power marketing metering equipment. It is used to collect the raw operating data stream of the metering equipment in real time, and perform data preprocessing, feature extraction and preliminary anomaly detection locally to generate local anomaly warning events with confidence scores.

[0046] The model management module, deployed on a collaborative decision-making and model management platform at regional aggregation nodes or in the cloud, is used to receive and aggregate early warning events and feature data from multiple edge computing units, perform global anomaly verification, multi-source information fusion and early warning decision-making, and is responsible for generating and distributing incremental learning parameter packages for edge-side model updates.

[0047] The adaptive communication scheduling module, which connects the edge computing unit and the collaborative decision-making platform, is used to dynamically adjust the reporting strategy and transmission priority of early warning events and feature data based on network bandwidth status, device importance level, and confidence level of early warning events.

[0048] The warehouse storage module stores multi-scenario anomaly feature libraries and model repositories in the collaborative decision-making platform. It is used to store standardized feature vectors and corresponding detection model baseline versions for different regions, user types and anomaly patterns, providing support for the initialization and differentiated deployment of edge-side models.

[0049] Example 2

[0050] This embodiment is an explanation based on Embodiment 1. Please refer to it. Figure 1 Specifically, the overall architecture of this system consists of edge computing units deployed on the power marketing metering equipment side, a collaborative decision-making and model management platform deployed on regional aggregation nodes or the cloud, an adaptive communication scheduling module connecting the two, and a multi-scenario anomaly feature library and model repository stored on the platform side. The edge computing units, acting as the system's nerve endings, are directly embedded or deployed nearby in smart meters, concentrators, dedicated transformer terminals, or their aggregation nodes, responsible for front-end data perception and preliminary intelligent analysis. The collaborative decision-making and model management platform, acting as the system's brain and central hub, is deployed on a regional data center or provincial cloud platform, responsible for overall situation assessment, strategy formulation, and knowledge evolution. The adaptive communication scheduling module, like an intelligent nervous system, dynamically adjusts the information flow between the edge and the cloud. The multi-scenario anomaly feature library and model repository serve as the system's knowledge base, storing refined anomaly patterns and detection models.

[0051] The core task of the edge computing unit is to acquire raw, multimodal operational data streams from the target power marketing metering equipment in real time. The data acquisition interface uses standard DL / T645, Modbus, or HPLC-based high-speed power line carrier communication protocols to obtain metering data such as voltage, current, power, forward and reverse active energy readings, and reactive energy readings from connected smart meters at fixed intervals or event triggering methods. Simultaneously, the interface also reads device status words, including battery voltage, clock status, relay status, and event records such as alarm information like voltage loss, current loss, and cover opening, forming a multidimensional raw data stream containing time-series measurements and status events. Before entering the processing flow, all raw data must pass preset data validity verification rules, such as checking whether the values ​​are within a physically reasonable range and whether the timestamps are continuous and reasonable. For abnormal or missing data points, linear interpolation based on the mean of the preceding and following windows is used, or the data is marked as invalid for subsequent processing.

[0052] After acquiring the raw running data stream, the system executes step S120, which involves sliding window segmentation and parallel feature extraction of the data stream. The lightweight time-series feature extraction module first defines a sliding window with a length of L sampling points and a sliding step size of S sampling points, cutting the continuous data stream into a series of overlapping or non-overlapping data segments. For the data within each window, the module calculates three types of features in parallel. The statistical feature calculation unit calculates the mean of voltage, current, and power sequences within the window to reflect the average level, calculates the variance to measure the degree of fluctuation, calculates the skewness to assess the asymmetry of the distribution, and calculates the kurtosis to detect the sharpness or flatness of the distribution. In addition, it calculates the ratio of the difference between the mean of the current window and the mean of the previous window as a rate of change feature within a preset time interval, used to capture sudden changes in load. The frequency domain feature extraction unit applies a Fast Fourier Transform to the current or power sequence within the window, converting the time-domain signal to the frequency domain and extracting the top K frequency components with the highest energy proportions and their corresponding amplitudes. These features play a crucial role in identifying harmonic anomalies introduced by nonlinear loads or specific power theft devices. The temporal dependency feature extraction unit employs a lightweight gated recurrent unit network to capture long-term dependencies in the data over time. This network takes a vector combining statistical and frequency domain features at one time step as input. Its hidden state update process is precisely described by the following formula:

[0053] ;

[0054] ;

[0055] ;

[0056] ; where x t Let h be the input feature at time t. t−1 The hidden state of the previous moment, z t r t These are the update door and the reset door, respectively. z W r W is the trainable parameter matrix, σ is the sigmoid function, and ⊙ represents element-wise multiplication; the hidden state h at the last time step... t As a feature vector representing the temporal dependencies of the entire window.

[0057] Example 3

[0058] This embodiment is an explanation based on Embodiment 1. Please refer to it. Figure 1Specifically, steps S130 and S140 are executed, namely, anomaly detection and confidence fusion of the mixed feature vectors. The integrated anomaly detection engine internally runs two heterogeneous detection models in parallel. The unsupervised model based on isolated forests receives the mixed feature vectors, constructs multiple isolation trees, calculates the average path length required to isolate the data point, and normalizes it into an anomaly score s between 0 and 1. if The closer the score is to 1, the more likely the data point is to be an anomaly of an unknown pattern. The supervised model based on gradient boosting decision trees receives the same feature vector. This model has been pre-trained in the cloud using massive amounts of historical normal and anomalous samples, and can output the probability distribution of the data point belonging to predefined "normal" and various "abnormal" categories. The predicted probability for the "abnormal" category is denoted as p. gbt The local event generator weights and fuses the outputs of the two models according to a preset fusion strategy, calculating a comprehensive anomaly confidence score C. The specific strategy is as follows: ;

[0059] The fusion weight α of the isolated forest model and the gradient boosting decision tree model is dynamically updated periodically to improve the stability of multi-model collaborative detection. The evaluation period is defined as the most recent 24 hours, during which the F1 scores of the two models on a globally validated sample set are calculated. if With F1 gbt The difference between the two is defined as: The weight update rule is as follows: ;

[0060] Where λ is a positive constant controlling the weight update step size, which can be set to 0.1 according to the system stability requirements during the trial operation phase. To ensure that the model fusion result does not become unstable, when the updated... When the value exceeds the range [0.3, 0.7], it is truncated to the boundary value of the range to ensure that the two types of models always maintain a moderately balanced contribution during the fusion.

[0061] Example 4

[0062] This embodiment is an explanation based on Embodiment 1. Please refer to it. Figure 1, specifically: Based on the calculated comprehensive anomaly confidence score C, the system executes step S150 to make a local decision and trigger communication scheduling. Two thresholds are preset in the local event generator: a high threshold Th and a low threshold Tl. When C≥Th, it is determined as a high-confidence anomaly, and a structured local warning event is immediately generated. The event data packet contains the following fields: the device unique identification code, the anomaly occurrence timestamp accurate to milliseconds, the preliminarily determined anomaly type, the confidence score C value, and the key feature subset selected from the mixed feature vector. This event will be immediately submitted to the adaptive communication scheduling module for reporting. When Tl≤C<Th, it is determined as a suspicious event, and a complete warning event is not generated temporarily. Instead, the complete mixed feature vector, device identifier, and timestamp of the current window are packed and stored in the local circular buffer. For the data window with C<Tl, it is regarded as normal, and only the local normal data sample library is updated for subsequent model fine-tuning reference.

[0063] The above first preset threshold, second preset threshold, high threshold T h , low threshold T l and emergency threshold T e are all determined by offline statistical analysis of historical operation data. Specifically, for the samples globally verified and labeled as normal and abnormal, the distribution of the comprehensive anomaly confidence score C is statistically analyzed. The 95th percentile of the normal sample distribution is used as the low threshold T l , the 90th percentile of the abnormal sample distribution is used as the first preset threshold, and the 99th percentile is used as the high threshold T h and the reference range of the emergency threshold T e . During actual deployment, the operation and maintenance personnel fine-tune within this range according to the on-site false alarm rate and missed alarm rate requirements and then solidify them into the configuration file.

[0064] The adaptive communication scheduling module starts working after receiving the reporting request or cached data. The built-in bandwidth sensor in it continuously sends probe data packets to monitor the network round-trip delay and available bandwidth estimation from the current edge node to the collaborative decision-making platform in real time. Multiple reporting policies are predefined in the policy rule library. For example, when the bandwidth sensor reports that the network bandwidth is充裕 and the confidence score C of the event to be reported is higher than a higher emergency threshold T eWhen network bandwidth is limited, the module uses a "full event mode," reporting local early warning event data packets directly without compression. When network bandwidth is limited, the module starts a data compression encoder to process the feature vectors to be reported: if a certain loss of accuracy is acceptable, principal component analysis is used to project them into a low-dimensional space; if lossless compression is required, a dictionary built based on historical feature vectors is used for encoding and compression. The compressed data is reported together with the event summary. For suspicious event feature data in the buffer, when the network is idle or the preset batch reporting time window is reached, the module uses a "delayed batch mode," packaging and compressing the feature data of multiple suspicious events before reporting them together. The module also adjusts priorities according to the importance level of the equipment; for metering equipment of important industrial and commercial users or key nodes, the event reporting priority is automatically increased.

[0065] Example 5

[0066] For an anomaly warning method for electricity marketing metering equipment based on edge computing, please refer to [link / reference]. Figure 2 Specifically, on the collaborative decision-making platform side, step S160 is executed to aggregate and verify global events. The global event aggregator continuously receives reported information from hundreds of thousands of edge computing units across the network. It first performs spatial clustering according to the topological relationships of the equipment, such as substations, feeders, and distribution areas, and then performs temporal clustering according to time granularities such as 15 minutes and 1 hour. Through cluster analysis, the platform can identify spatially concentrated or temporally continuous correlated anomaly patterns. For example, if multiple users in the same distribution area experience current imbalance anomalies simultaneously, it may indicate a fault in the distribution area's main meter or line interference. The multi-source information fusion decision module further deepens the analysis. It correlates the individual anomaly features reported by the edge with concurrent multi-source data accessed by the platform. This data includes real-time temperature, humidity, and wind speed data obtained from meteorological departments, grid frequency and bus voltage data obtained from the energy management system, and information such as users' historical electricity consumption, electricity bills, and credit records obtained from the marketing business system. The module constructs a Bayesian network, using edge detection anomalies as observational evidence and grid conditions, weather conditions, and user behavior as conditional evidence. Through Bayesian inference, it calculates the posterior probability that the anomaly is indeed caused by equipment failure or electricity theft, given all this evidence. This posterior probability serves as the final confidence level for global verification, significantly higher than the confidence level of a single edge detection. For example, a voltage sag reported by an edge might be attributed to grid operation rather than equipment failure if the grid dispatch records show a switching operation in the area during the same period; conversely, if there is no grid operation and other users on the same line are functioning normally, the probability that the anomaly is a genuine equipment failure is greatly increased.

[0067] The collaborative decision-making platform also executes step S170, namely model evolution management. The model evolution management module continuously monitors the detection performance metrics of all edge nodes, including false positive rate, false negative rate, and the distribution of reported feature data. This module employs statistical process control methods, such as calculating the moving average and moving standard deviation of the mean vector of a certain type of anomaly feature vector. When the deviation exceeds a preset control limit, it is determined that feature distribution drift has occurred. Alternatively, if more than 5% of the edge nodes in a certain area have a false positive rate higher than a set threshold for the same anomaly type for three consecutive days, the model update process will also be triggered. After the update process is initiated, the module first retrieves the lightweight baseline model M corresponding to that anomaly type from the model repository. base .

[0068] The model evolution management module employs statistical process control methods to monitor feature distribution drift. Using the mean vector and covariance matrix of each dimension of the feature vector as statistics, a moving window is used to calculate its confidence interval, with historical stable operating data serving as the baseline. The difference between the current window statistic and the baseline statistic is quantified using Mahalanobis distance. When this distance exceeds the control limit calculated based on a significance level of 0.05, a significant feature distribution drift is determined, meaning the confidence interval shift exceeds the acceptable range.

[0069] Subsequently, from the globally validated high-confidence sample library, all relevant positive and negative samples since the last model update are collected to form the incremental training dataset D. new Utilizing D in the cloud new For M base Incremental training is performed in fixed rounds. To reduce computation and communication overhead, training typically involves freezing some lower network layers and updating only the parameters of the last few fully connected layers. After training, a new model M is obtained. new Next, calculate M. new With M base The parameter difference matrix ΔW corresponds to the updateable layer. To generate the smallest possible update package, ΔW is sparsified by setting small parameters with absolute values ​​less than a threshold to zero, and then low-bit quantization encoding is applied to the non-zero parameters. The final incremental learning parameter package is typically only five to ten percent the size of the complete model file.

[0070] Finally, step S180 is executed to complete the edge-side hot update of the model. The collaborative decision-making platform distributes the generated incremental learning parameter packets to all relevant edge computing units through a reliable channel established by the adaptive communication scheduling module. After receiving the parameter packets, the edge units first perform integrity verification and decoding, and then, when their local detection engines are idle, they compare the parameter difference ΔW with the local model M. localThe corresponding parameters are added together to complete the hot update of the model. The entire update process does not interrupt the normal detection service, realizing seamless adaptive evolution of detection capabilities. A multi-scenario anomaly feature library and model repository provide the basic support for the entire evolution process. The feature library is finely divided into four categories according to the root cause of the anomaly: equipment failure, electricity theft, metering error, and environmental impact. Each category is further subdivided into subcategories. For example, the electricity theft category includes subcategories such as "short-circuit current loop", "magnetic field interference", and "software tampering". Each subcategory corresponds to a standard feature template, which is a multi-dimensional vector that defines the most typical and stable feature manifestations of this type of anomaly. The model repository maintains a corresponding pre-trained and deep-optimized lightweight detection model baseline for each feature template, ensuring that edge units can quickly obtain a model with basic detection capabilities during initialization or reset.

[0071] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An edge-computing-based power marketing metering equipment anomaly early warning system, characterized in that: The edge-side abnormality early warning processing module, the model management module, the adaptive communication scheduling module and the warehouse storage module are included. The edge-side abnormality early warning processing module is deployed in an edge computing unit at the side of power marketing metering equipment, is used for collecting original operation data flow of the metering equipment in real time, and executes data preprocessing, feature extraction and preliminary abnormality detection locally to generate local abnormality early warning events with confidence scores. The model management module is deployed in a regional convergence node or a collaborative decision and model management platform in the cloud, is used for receiving and aggregating early warning events and feature data from multiple edge computing units, executing global abnormality verification, multi-source information fusion and early warning decision, and being responsible for generating and issuing incremental learning parameter packages for edge-side model updating. The adaptive communication scheduling module is connected between the edge computing unit and the collaborative decision platform, is used for dynamically adjusting the reporting strategy and transmission priority of early warning events and feature data according to the network bandwidth state, the equipment importance level and the confidence of the early warning events. The warehouse storage module is stored in a multi-scenario abnormality feature library and a model warehouse in the collaborative decision platform, is used for storing standardized feature vectors and corresponding detection model baseline versions for different regions, user types and abnormality modes, and providing support for the initialization and differential deployment of the edge-side model. 2.The edge computing-based power marketing metering device anomaly early warning system according to claim 1, characterized in that: The edge computing unit includes a data acquisition interface, a lightweight time series feature extraction module, an integrated abnormality detection engine and a local event generator. The data acquisition interface periodically or event-triggeredly acquires voltage, current, power, electric energy indication value, event record and device state word multi-dimensional original data flow from smart meters and data acquisition terminals. The lightweight time series feature extraction module adopts a sliding window mechanism to segment the original data flow, and calculates statistical features, frequency domain features and time series dependent features for each window data. The integrated abnormality detection engine runs at least two heterogeneous detection models in parallel, including an unsupervised model based on an isolation forest for detecting unknown mode abnormalities, and a supervised model based on a gradient boosting decision tree for identifying known type abnormalities; the outputs of the two models are fused through a weighted voting mechanism, and the weights are dynamically adjusted according to the F1 score of the model on the historical verification set. The local event generator receives the abnormality label and confidence score output by the integrated abnormality detection engine, generates a local early warning event including the device identifier, the timestamp, the abnormality type, the confidence and the key feature vector when the confidence score exceeds a first preset threshold; for a suspicious event with a confidence score between the first preset threshold and a second preset threshold, only the feature vector is extracted and cached. 3.The edge computing-based power marketing metering device anomaly early warning system according to claim 2, characterized in that: In the lightweight time series feature extraction module, the time series dependent feature extraction adopts a lightweight gated recurrent unit network, and the hidden state update formula is: ； ； ； ; where x t is the input feature at time t, h t−1 is the hidden state at the previous time, z t , r t are the update gate and the reset gate, respectively, W z , W r , W are trainable parameter matrices, σ is the sigmoid function, and ⊙ denotes element-wise multiplication; the hidden state h t at the last time step is taken as the feature vector representing the whole window temporal dependency.

4. The edge computing-based power marketing metering equipment anomaly early warning system according to claim 2, characterized in that: The weighting fusion strategy in the integrated anomaly detection engine is specifically: assuming that the anomaly score output by the Isolation Forest model is s if , the prediction probability of the Gradient Boosting Decision Tree model for the "anomaly" category is p gbt , and the preset fusion weights are α and (1−α) respectively, the calculation method of the comprehensive anomaly confidence score C is , wherein the weight α is dynamically adjusted according to the F1-score difference of the two models in the latest evaluation period, and the adjustment range is limited in the interval [0.3, 0.7].

5. The edge computing-based power marketing metering equipment anomaly early warning system according to claim 1, characterized in that: The adaptive communication scheduling module has a bandwidth perceiver, a strategy rule library and a data compression encoder built-in. The bandwidth perceiver monitors the network round-trip delay and available bandwidth from the edge node to the cloud platform in real time. The strategy rule base defines the reporting strategy under different combination conditions: when the network bandwidth is sufficient and the pre-warning event confidence is higher than the preset high threshold, the complete event data reporting mode is adopted; when the network bandwidth is limited, only the event summary and the dimension reduction projection of the high-dimensional feature vector are reported; for suspicious events with low confidence but high feature novelty, the delayed batch reporting mode is adopted; The data compression encoder adopts principal component analysis for lossy compression or dictionary encoding for lossless compression on the feature vector to be reported. 6.The edge computing-based power marketing metering device anomaly early warning system according to claim 1, characterized in that: The management platform includes a global event aggregator, a multi-source information fusion decision module, and a model evolution management module; The global event aggregator receives pre-warning events and feature data reported from multiple edge computing units, performs clustering analysis according to the area, substation, and time window of the device, and identifies spatial or temporal correlation anomaly patterns; The multi-source information fusion decision module correlates the abnormal features reported by the edge with the contemporaneous meteorological data, power grid operating condition data, and user historical power consumption profiles stored on the platform side, and calculates the posterior probability that the anomaly is a real fault given the multiple source evidence through the construction of a Bayesian network; The model evolution management module continuously monitors the detection performance indicators and feature data distribution changes reported by all edge computing units, and triggers the model update process when it detects that the feature distribution has drifted significantly or the false positive rate is continuously higher than the set threshold.

7. The edge computing-based power marketing metering equipment anomaly early warning system according to claim 6, characterized in that: The model evolution management module triggered model update process includes: loading the baseline model Mbase of the target abnormal type from the model repository; Collecting a set of high-confidence positive and negative samples D confirmed by global validation since the last update new ; D new on the cloud base M new ; Compute M new With M base The difference AW of the corresponding layer parameters; sparse AW and quantization coding, generating incremental learning parameter package. 8.The edge computing-based power marketing metering device anomaly early warning system of claim 5, wherein: The adaptive communication scheduling module further includes an event importance dynamic evaluator, which calculates the event importance index Ie according to the following conditions: the criticality level of the device in the regional power grid topology; the power grid load fluctuation rate corresponding to the abnormal occurrence period; the confidence interval shift of the edge-side detection model in the recent window; and the deviation of the abnormal feature vector relative to the nearest neighbor feature cluster in the feature library; When the event importance index Ie exceeds the set importance threshold, even if the network bandwidth is limited, the priority escalation mechanism is triggered to send the event to the collaborative decision platform through the highest priority channel. 9.The edge computing-based power marketing metering device anomaly early warning system according to claim 6, characterized in that: The model management platform further includes a cross-region anomaly pattern migration analysis module for identifying the migration rules of anomaly patterns between different regions, which specifically includes: constructing an anomaly pattern transfer matrix according to the time sequence of historical abnormal events from different regions; identifying the anomaly pattern chain that spreads across regions based on graph clustering algorithms; when it is detected that the anomaly pattern has a cross-region diffusion trend, issuing a quick reinforcement model or abnormal feature fragment to the edge unit of the affected region in advance to improve the early identification ability of the region, realizing cross-region anomaly linkage warning and proactive adaptation of the model.

10. The edge computing-based power marketing metering equipment anomaly early warning method is applied to any one of claims 1-9, characterized in that: The specific steps are: Step S110, at the edge computing unit side, real-time acquisition of the original multi-modal operation data stream of the target electric power marketing metering device; Step S120, sliding window segmentation and parallel feature extraction of the original operation data stream to obtain a mixed feature vector containing statistical features, frequency domain features, and time series dependent features; Step S130, the mixed feature vector is input into an isolation forest model and a gradient boosting decision tree model in the integrated anomaly detection engine to obtain an unsupervised anomaly score and a supervised classification probability, respectively; Step S140, based on a preset fusion weight, the unsupervised anomaly score and the supervised classification probability are weighted and fused to calculate a comprehensive anomaly confidence score of the current data window; Step S150, according to a comparison result of the comprehensive anomaly confidence score and a preset threshold, a local warning event or cached feature data is generated, and an adaptive communication scheduling process is triggered; Step S160, on the side of the collaborative decision platform, report information from multiple edge nodes is received and aggregated, and Bayesian network inference is performed in combination with power grid multi-source data to complete global anomaly verification and final decision; Step S170, according to the global verification result and the performance index monitored continuously, it is judged whether the model evolution process needs to be started, and if so, incremental learning is performed and a parameter update package is generated; Step S180, the parameter update package is issued to the related edge computing unit, and the edge unit receives and performs hot update on the local model.

Images