Granular intuitionistic fuzzy modeling based power internet of things anomaly detection method and system

Abstract

This invention belongs to the field of power anomaly detection technology, specifically relating to a power Internet of Things (IoT) anomaly detection method and system based on granular-sphere intuitionistic fuzzy modeling. The method includes: constructing multiple training granular-sphere intuitionistic fuzzy models with corresponding known category labels based on known normal and abnormal data, forming a training granular-sphere intuitionistic fuzzy set; constructing multiple sets of test granular-sphere intuitionistic fuzzy models with unknown categories using the training granular-sphere intuitionistic fuzzy set as a reference; calculating the fuzzy distance between each test granular-sphere intuitionistic fuzzy model and all training granular-sphere intuitionistic fuzzy models; assigning the known category label corresponding to the training granular-sphere intuitionistic fuzzy model with the smallest fuzzy distance to the corresponding unknown category data; determining whether the known category label assigned to the unknown category data is an anomaly label; if so, determining the unknown category data as anomaly data and generating structured alarm information. This invention significantly improves detection accuracy, has high computational efficiency, and possesses strong interpretability.

Description

Technical Field

[0001] This invention belongs to the field of power Internet of Things (IoT) anomaly detection technology, specifically relating to a power IoT anomaly detection method and system based on particle-sphere intuitionistic fuzzy modeling. Background Technology

[0002] Currently, the Power Internet of Things (PIoT), as a typical representative of the Industrial Internet of Things (IIoT) in the energy sector, has been deeply integrated into key infrastructures such as smart substations, distribution automation, electricity consumption information collection, and new energy grid connection. Its 24 / 7 continuous operation, diverse heterogeneous terminals (such as smart meters, FTUs, DTUs, and PMUs), hybrid communication protocols (IEC 61850, DL / T 645, MQTT, CoAP), and edge-cloud collaborative architecture make it a high-value target for cyberattacks. Typical threats include: Data Deception Injection (FDIA) attacks, Denial-of-Service (DoS) attacks, firmware tampering, and man-in-the-middle attacks. Ensuring the secure and stable operation of the IIoT, protecting communication and physical privacy, safeguarding edge devices from virus attacks, and preventing unauthorized access are among the most critical issues in modern industrial operations.

[0003] Intrusion Detection Systems (IDS) are a crucial defense mechanism for the cybersecurity of the Industrial Internet of Things (IIoT). IDS collects information about devices and networks within the IIoT, analyzes and identifies this data, and determines whether abnormal behavior exists within the system. Traditional PIoT anomaly detection technologies primarily fall into two categories to address security risks in PIoT networks:

[0004] (1) Misuse-based detection methods: rely on predefined attack signature libraries, which have a high detection rate for known attacks, but are completely ineffective when facing new zero-day attacks or advanced persistent threats (APTs) (such as Snort and Suricata rule engines); and the rule maintenance cost is high, making it difficult to adapt to the rapid iteration of PIoT protocols and the heterogeneity of devices.

[0005] (2) Anomaly-based detection methods: including statistical models (such as CUSUM, ARIMA): assuming that normal traffic follows a specific distribution, sensitive to mutation attacks, but poor robustness to a few abnormal traffic; machine learning models (such as SVM, random forest, XGBoost): although they have certain generalization ability, they are easily affected by high-dimensional sparse features, and their performance in terms of detection accuracy and false alarm rate is not good; deep learning models (such as CNN-LSTM, Transformer): have high accuracy under massive data, but the model has a large number of parameters and high inference latency, making it difficult to deploy on resource-constrained edge terminals (such as distribution terminal units DTU), and the decision-making process is a "black box" with a lack of interpretability, making it difficult to meet the requirements of power system security audit; fuzzy methods: such as the Dynamic Intuitive Fuzzy Set (DIFS) model proposed by Xie et al. (IEEE Trans. Fuzzy Syst., 2021), which models normal / abnormal traffic as Intuitive Fuzzy Patterns (IFS), and achieves classification through fuzzy distance metrics, with the advantages of low resource overhead and interpretability. However, this method directly constructs the IFS from the original samples without considering the characteristics of PIoT data such as fuzzy class boundaries, uneven local density, and overlapping feature spaces, resulting in coarse-grained and inaccurate membership / non-membership modeling; especially when the proportion of attack samples is low and the classes are imbalanced, the false alarm rate increases significantly.

[0006] To improve the accuracy of models in identifying various attacks in the power IoT, improvements and optimizations to traditional methods are essential. To this end, existing technologies introduce granular sphere computation to improve the performance of intuitionistic fuzzy methods in anomaly detection within the power IoT. Granular sphere computation, a granular computation method that has emerged in recent years, uses hyperspheres (granules) to cover the sample space, representing point samples. A granule can be viewed as a spherical region distributed around the cluster centroid, effectively capturing the similarity between data points while providing a more flexible clustering representation. The introduction of granules preserves the overall data structure, reduces noise interference, and supports more detailed and hierarchical analysis, thereby revealing the intrinsic structure of the data. However, mainstream purity-based granule generation methods employ a global iterative splitting strategy. To meet high purity thresholds (e.g., purity ≥ 0.9), a large number of small granules are generated in overlapping category regions, leading to three problems: First, the number of granules expands, drastically increasing training overhead; second, the statistical properties of samples within small granules are weak, resulting in large biases in membership estimation; third, fragmented granule coverage weakens the ability to represent local data distributions.

[0007] In summary, existing anomaly detection technologies for the power Internet of Things (PIoT) have significant shortcomings in terms of detection accuracy, computational efficiency, model interpretability, and adaptability to the unique data distribution of PIoT, which is characterized by sparseness, heterogeneity, and ambiguous boundaries. There is an urgent need for an anomaly detection method that balances high accuracy, low overhead, strong interpretability, and adaptability to the characteristics of PIoT data. Summary of the Invention

[0008] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a power Internet of Things anomaly detection method and system based on particle-sphere intuition fuzzy modeling, so as to solve at least some of the defects existing in the prior art.

[0009] To achieve the above objectives, the present invention adopts the following technical solution: a power Internet of Things anomaly detection method based on particle-sphere intuitionistic fuzzy modeling, comprising the following steps:

[0010] S1. Based on the known normal and abnormal data of the power Internet of Things, construct multiple training particle-sphere intuitionistic fuzzy models with corresponding known category labels, and form a training particle-sphere intuitionistic fuzzy set.

[0011] S2. Using the training particle intuition fuzzy set as a reference, construct multiple unknown-category particle intuition fuzzy models based on the unknown category data of the power Internet of Things, and form the particle intuition fuzzy set to be tested.

[0012] S3. Calculate the fuzzy distance between each test particle intuitionistic fuzzy model in the test particle intuitionistic fuzzy set and all training particle intuitionistic fuzzy models in the training particle intuitionistic fuzzy set.

[0013] S4. Assign the known category label corresponding to the training particle-sphere intuitionistic fuzzy model with the smallest fuzzy distance to the particle-sphere intuitionistic fuzzy model to the unknown category data corresponding to the particle-sphere intuitionistic fuzzy model to be tested.

[0014] S5. Determine whether the known category label assigned to the unknown category data is an abnormal label; if not, determine that the unknown category data is normal data; if yes, determine that the unknown category data is abnormal data and generate structured alarm information.

[0015] Preferably, the specific method of step S1 is as follows:

[0016] S11. Collect known normal data and known abnormal data from the power Internet of Things, and preprocess the known normal data and known abnormal data to obtain a dataset;

[0017] S12. Fit the dataset using a random forest classifier, calculate the importance score of each data feature based on the average impurity when each decision tree node splits, and select the top-ranked data features to obtain the training set.

[0018] S13. First, divide the training set into multiple independent subsets according to normal and abnormal labels, and then run K-means clustering on each subset separately to generate multiple training particles.

[0019] S14. Using the geometric center of each training particle as a reference point, calculate the membership degree, non-membership degree, and hesitation degree of the training particle based on the distance of all data in the training particle to the geometric center, in order to construct the training particle intuition fuzzy model corresponding to the category label and form the training particle intuition fuzzy set.

[0020] Preferably, in step S11, the preprocessing is cleaning, transformation, and normalization processing. Specifically, the method is as follows: zero-filling is performed on missing data values, and non-numerical data is encoded; then, the numerical features of all data are normalized by maximum and minimum.

[0021] Preferably, in step S1, the known normal data and known abnormal data are multi-source heterogeneous data streams from the substation monitoring system, distribution automation terminal, smart meter concentrator and edge gateway. The multi-source heterogeneous data streams include numerical telemetry signals, discrete event logs, communication message fields and timestamp information.

[0022] Preferably, in step S12, the top 10 to 20 most important data features are selected to form a training set.

[0023] Preferably, the specific method of step S2 is as follows:

[0024] S21. Collect unknown category data from the power Internet of Things, and clean, transform, and normalize the unknown category data to obtain the dataset to be tested.

[0025] S22. Using the training particle-sphere intuition fuzzy set as a reference, construct multiple unknown-class particle-sphere intuition fuzzy models to be tested, and form the particle-sphere intuition fuzzy set to be tested.

[0026] Preferably, in step S5, the structured alarm information includes anomaly label information, confidence level, attributes of the training particle-sphere intuitionistic fuzzy model most similar to the anomaly data, and key explanatory fields.

[0027] Preferably, the key explanation fields include the device number from which the abnormal data originated and the device's operating time.

[0028] Preferably, the structured alarm information is synchronously pushed to the power monitoring master station platform.

[0029] Meanwhile, this invention also provides a power Internet of Things anomaly detection system based on granular-spherical intuitionistic fuzzy modeling, comprising:

[0030] The known category particle generation module is configured to construct multiple training particle intuition fuzzy models corresponding to known category labels based on the known normal and abnormal data of the power Internet of Things, and form a training particle intuition fuzzy set.

[0031] The unknown category particle generation module is configured to construct multiple unknown category intuitionistic fuzzy models of the particles to be tested based on the unknown category data of the power Internet of Things, and form an intuitionistic fuzzy set of the particles to be tested.

[0032] The intuitionistic fuzzy distance calculation module is configured to calculate the fuzzy distance between each intuitionistic fuzzy model of the test particle intuitionistic fuzzy set and all training particle intuitionistic fuzzy models in the training particle intuitionistic fuzzy set.

[0033] The known category label assignment module is configured to assign the known category label of the training particle-sphere intuitionistic fuzzy model that has the smallest fuzzy distance to the particle-sphere intuitionistic fuzzy model under test to the unknown category data corresponding to the particle-sphere intuitionistic fuzzy model under test.

[0034] The anomaly detection output module is configured to determine whether the known category label assigned to unknown category data is an anomaly label; if not, the unknown category data is determined to be normal data; if so, the unknown category data is determined to be anomaly data, and a structured alarm message is generated.

[0035] Compared with existing technologies, the present invention has the following advantages: The training particles in the present invention, as semantically clear local data units, intuitively reflect the uncertainty characteristics of "typical normal operating conditions" or "a certain type of attack feature region" through their intuitionistic fuzzy triples. The decision-making process is transparent and traceable, possessing strong interpretability. The total number of training particles in the present invention is controllable and requires no iterative splitting, saving more than 50% of training time. The model has a small number of parameters, high computational efficiency, and can be directly deployed on resource-constrained edge devices such as terminal units. The generation of the intuitionistic fuzzy model of the test particles and the discrimination of new unknown category data are based on training particles of known categories rather than original data points, reducing computational costs and improving generalization performance. The method of the present invention achieves an accuracy of 0.9978 on the X-Industrial IoT ID IoT typical dataset, with a false alarm rate as low as 0.0015, which is two orders of magnitude lower than existing dynamic intuitionistic fuzzy set methods, significantly improving detection accuracy. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on the drawings described below without creative effort.

[0037] Figure 1 This is a flowchart illustrating the process of the power Internet of Things anomaly detection method based on particle-sphere intuitionistic fuzzy modeling, according to an embodiment of the present invention.

[0038] Figure 2This is a schematic diagram of the dataset in an embodiment of the present invention.

[0039] Figure 3 This is a schematic diagram illustrating the relationship between training particles and data in an embodiment of the present invention.

[0040] Figure 4 This is a schematic diagram of the training particle set in an embodiment of the present invention. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention. To make the above features and advantages of this invention more apparent and understandable, specific embodiments are provided below with reference to the accompanying drawings for detailed description.

[0042] Example: Figure 1 As shown, a power Internet of Things (IoT) anomaly detection method based on granular-spherical intuitionistic fuzzy modeling includes the following steps:

[0043] S1. Based on the known normal and abnormal data of the power Internet of Things, construct multiple training particle-sphere intuitionistic fuzzy models with corresponding known category labels, and form a training particle-sphere intuitionistic fuzzy set.

[0044] S2. Using the training particle intuition fuzzy set as a reference, construct multiple unknown-category particle intuition fuzzy models based on the unknown category data of the power Internet of Things, and form the particle intuition fuzzy set to be tested.

[0045] S3. Calculate the fuzzy distance between each test particle intuitionistic fuzzy model in the test particle intuitionistic fuzzy set and all training particle intuitionistic fuzzy models in the training particle intuitionistic fuzzy set.

[0046] S4. Assign the known category label corresponding to the training particle-sphere intuitionistic fuzzy model with the smallest fuzzy distance to the particle-sphere intuitionistic fuzzy model to the unknown category data corresponding to the particle-sphere intuitionistic fuzzy model to be tested.

[0047] S5. Determine whether the known category label assigned to the unknown category data is an abnormal label; if not, determine that the unknown category data is normal data; if yes, determine that the unknown category data is abnormal data and generate structured alarm information.

[0048] In this embodiment, the specific method of step S1 is as follows:

[0049] S11. Collect known normal data and known abnormal data from the power Internet of Things, and preprocess the known normal data and known abnormal data to obtain the dataset D=x1,x2,...,x n ;

[0050] S12. Fit the dataset using a random forest classifier, calculate the importance score of each data feature based on the average impurity when each decision tree node splits, and select the top-ranked data features to obtain the training set.

[0051] S13. First, divide the training set into multiple (e.g., k) independent subsets D'=D'1,D'2,...,D'' based on normal and abnormal labels. k Where k is the number of categories, K-means clustering is then performed separately on each subset to generate multiple clusters (e.g., m). k (number) training pellets GB i This forms a training set of particles G' = GB1, GB2, ..., GB M ,in ;

[0052] The attributes of the training pellets are defined as follows:

[0053] ;

[0054] Among them, GB i For the i-th training ball, c i r is the center of the i-th training particle. i Let l be the radius of the i-th training particle. i Let D be the category label for the i-th training particle. i The data contained in the i-th training particle;

[0055] S14. Using the geometric center of each training particle as a reference point, and based on the distances of all data within the training particle to the geometric center, calculate the membership, non-membership, and hesitation of that training particle using weighted averages to construct an intuitionistic fuzzy model for the training particle corresponding to the category label, and form the training particle intuitionistic fuzzy set as follows:

[0056] ;

[0057] ;

[0058] ;

[0059] ;

[0060] Where A is the training particle intuition fuzzy set defined on the universe of discourse X, <μ A (x i ),vA (x i ),π A (x i )> represents the i-th training particle-sphere intuitionistic fuzzy model, μ A (x i ) represents the membership degree of the i-th training particle, v A (x i ) represents the non-membership degree of the i-th training particle, and π A (x i Let x be the hesitation degree of the i-th training ball. i The known category data used for training the i-th training.

[0061] In this embodiment, in step S11, the known normal data and known abnormal data are multi-source heterogeneous data streams from power equipment such as substation monitoring systems, distribution automation terminals, smart meter concentrators and edge gateways. The multi-source heterogeneous data streams include numerical telemetry signals (such as voltage, current and power factor), discrete event logs (such as switch position changes and protection actions), communication message text (such as source / destination IP, port number and protocol type) segments and timestamp information.

[0062] In this embodiment, in step S11, the preprocessing is cleaning, transformation, and normalization. Specifically, the missing data values ​​are zero-filled, which often represents no signal or offline status of equipment in the power system, and non-numerical data are encoded. Then, the numerical characteristics of all data are normalized by max-min, and the influence of dimensions is eliminated by mapping them to the 0 to 1 interval.

[0063] In this embodiment, step S12 reduces dimensionality interference and enhances the contribution of key data features by selecting multiple data features with high importance ranking. For example, the training set is composed of the top 10 to 20 data features (i.e., K values), which balances information integrity and dimensionality compression effect.

[0064] In this embodiment, step S13 no longer relies on global purity splitting. Instead, based on the known labels of the data in the training set (i.e., training samples), the training samples are pre-divided into independent subsets according to categories. For example, the same abnormal category (such as attack) is divided into the same subset. Then, K-means clustering is run separately on each subset to generate a preset number of training particles. The cluster center is the particle center, and the radius is defined as the average Euclidean distance from all training samples within the particle to the center. The generated training particle set is stored according to category. Each training particle records its category label, center coordinates, radius, and the number of the training samples it contains. This strategy ensures that the training samples within each training particle strictly belong to the same category, and the purity is always 1. This fundamentally avoids interference from different categories and excessive splitting. No additional verification or secondary splitting is required, thus effectively avoiding the problem of excessive splitting in the category boundary region of traditional purity-driven methods.

[0065] In this embodiment, step S14 employs a training particle intuitionistic fuzzy model, using each training particle as a basic modeling unit and its geometric center as a reference point. The membership, non-membership, and hesitation triplet <μ is calculated for each training particle based on a weighted average of the distances from all training samples within the training particle to the center. A (x i ),v A (x i ),π A (x i The membership degree is defined as the average of the differences between all training samples and the mean of the training samples, i.e., the overall expectation of how close each training sample is to the center, reflecting the overall degree of closeness of the training samples to the center; the non-membership degree is the average of the differences between each training sample and the mean of the training samples, reflecting the average level of deviation of the group from the typical state, i.e., the overall trend of deviation from the center; the hesitation degree is obtained by subtracting the sum of membership degree and non-membership degree from 1, characterizing the uncertainty intensity of behavioral patterns within the area covered by the particle, i.e., quantifying the intensity of behavioral uncertainty in the local area, thereby achieving a refined uncertainty representation of the normal operation state of power equipment or specific attack patterns. When the data distribution is closely concentrated, the hesitation degree approaches 0, and when there are outliers or subgroup structures, the hesitation degree increases. This training particle intuitionistic fuzzy model retains the geometric coverage characteristics of the particle and incorporates the quantification ability of intuitionistic fuzzy sets for cognitive uncertainty.

[0066] In this embodiment, the specific method of step S2 is as follows:

[0067] S21. Collect unknown category data from the power Internet of Things, and clean, transform, and normalize the unknown category data to obtain the dataset to be tested. ;

[0068] S22. Using the training particle-sphere intuitionistic fuzzy set as a reference, construct multiple unknown-class particle-sphere intuitionistic fuzzy models to be tested, and form the particle-sphere intuitionistic fuzzy set to be tested as follows:

[0069] ;

[0070] ;

[0071] ;

[0072] ;

[0073] Where B is the intuitionistic fuzzy set of the particle-sphere to be measured, defined on the universe of discourse X. For the i-th particle-sphere intuitionistic fuzzy model, Let be the membership degree of the i-th particle to be tested. Let be the non-membership degree of the i-th particle to be tested. Let be the degree of hesitation for the i-th particle to be tested. Let be the i-th unknown category data to be tested.

[0074] In this embodiment, when a new frame of real-time data (the sample to be tested) arrives, the distance from the sample to the center of all training particles in the training particle set is first calculated, and this distance is used to construct an intuitive fuzzy model of the sample and its relationship to the centers of all training particles in the training particle set. Since the construction of the intuitive fuzzy model requires category information of the data, the sample data lacking category labels cannot be directly used to construct the intuitive fuzzy model. Therefore, it is necessary to indirectly construct the intuitive fuzzy model of the sample with unknown categories by using the training particle intuitive fuzzy set as a reference.

[0075] In this embodiment, the specific calculation formula for step S3 is as follows:

[0076] ;

[0077] Where, d AB (A,B) represents the fuzzy distance between the i-th training particle intuition fuzzy model in training particle intuition fuzzy set A and the i-th test particle intuition fuzzy model in test particle intuition fuzzy set B. α is the tendency parameter for membership indices, β is the tendency parameter for non-membership indices, and γ is the tendency parameter for hesitation indices. α≥0, β≥0, γ≥0, α+β+γ=2.

[0078] In this embodiment, firstly, step S2 constructs the corresponding intuitionistic fuzzy model of the unknown category data (i.e., the sample to be tested); then, step S3 calculates the normalized distance between each intuitionistic fuzzy model of the sample to be tested and the centers of all training intuitionistic fuzzy models. The above calculation formula assigns adjustable weights to the differences in membership, non-membership and hesitation to conform to the decision-making tendencies under different power grid environments. Finally, the comprehensive distance between the sample to be tested and each training intuitionistic fuzzy model is output; then, the smaller the distance, the greater the data similarity. Therefore, step S4 selects the training particle corresponding to the smallest distance (i.e., the training particle with the largest similarity) as a reference and assigns the label of the training particle to the sample to be tested.

[0079] In this embodiment, in step S5, the structured alarm information includes anomaly label information, confidence level, attributes of the training particle-sphere intuitionistic fuzzy model most similar to the anomaly data, and key explanatory fields. The key explanatory fields include the device number and device operating time from which the anomaly data originated. The structured alarm information is synchronously pushed to the power monitoring master station platform, facilitating rapid source tracing and manual verification of the alarm results by maintenance personnel.

[0080] This embodiment first constructs multiple training granular intuitionistic fuzzy models with corresponding known category labels from known normal and abnormal data of the power Internet of Things. Then, using the training granular intuitionistic fuzzy models as a reference, multiple test granular intuitionistic fuzzy models with unknown categories are constructed. Next, by calculating the fuzzy distance between each test granular intuitionistic fuzzy model and all training granular intuitionistic fuzzy models, the training granular intuitionistic fuzzy model with the smallest fuzzy distance to the test granular intuitionistic fuzzy model is determined, and its corresponding known category label is assigned to the unknown category data corresponding to the test granular intuitionistic fuzzy model. Finally, it is determined whether the known category label assigned to the unknown category data is an abnormal label. If so, a structured alarm message is generated, realizing a closed-loop processing from raw data input to abnormal alarm output. All detection results can be synchronously pushed to the power monitoring master station platform, forming a closed-loop security response.

[0081] The power IoT anomaly detection method based on granular-sphere intuitionistic fuzzy modeling in this embodiment has a single-sample inference latency of less than 0.7 milliseconds, meeting the millisecond-level alarm timeliness requirements of power systems. As shown in Table 1, experimental verification shows that this power IoT anomaly detection method based on granular-sphere intuitionistic fuzzy modeling achieves a stable accuracy of over 99.7% on IoT datasets such as X-Industrial IoT ID, with a false alarm rate of less than 0.2%, significantly outperforming existing mainstream methods and demonstrating its feasibility for engineering implementation.

[0082] Table 1. Test results of the method of the present invention:

[0083]

[0084] Figures 2 to 3 This is a visualization of the power IoT anomaly detection method based on granular-spherical intuitionistic fuzzy modeling in this embodiment on the TONNOT dataset. Figure 2 This shows the results of using 0.3% of the TONNOT dataset (1383 rows) and visualizing it using UMAP in two dimensions. Figure 3 This paper demonstrates the relationship between training particles and data (training samples) in a power IoT anomaly detection method based on particle-sphere intuitionistic fuzzy modeling. Figure 4 This paper presents a training ensemble for an anomaly detection method in the power Internet of Things (IoT) based on sphere-based intuitionistic fuzzy modeling. Subsequent generation of the target sphere-based intuitionistic fuzzy model and the identification of new unknown-class data are based on training spheres with known classes rather than the original data points, thus reducing computational costs and improving generalization performance.

[0085] The power Internet of Things anomaly detection method based on granular intuitionistic fuzzy modeling in this embodiment has the following advantages:

[0086] (1) Significantly improved detection accuracy: The method of the present invention achieves an accuracy of 0.9978 on the typical dataset of X-Industrial Internet of Things ID Internet of Things, with a false alarm rate as low as 0.0015, which is two orders of magnitude lower than the existing dynamic intuitionistic fuzzy set method;

[0087] (2) High computational efficiency: The total number of training particles in this invention is controllable and does not require iterative splitting, saving more than 50% of training time. The model has a small number of parameters and can be directly deployed on resource-constrained edge devices such as terminal units.

[0088] (3) Strong interpretability: The training particles in this invention are semantically clear local data units. Their intuitive fuzzy triples intuitively reflect the uncertainty characteristics of "typical normal working conditions" or "a certain type of attack feature area". The decision-making process is transparent and traceable.

[0089] (4) Excellent generalization ability: The method of the present invention maintains high stability in six benchmark tests covering the heterogeneous datasets of the power Internet of Things X-industrial Internet of Things ID, WUSTL-industrial Internet of Things and traditional network datasets, verifying its strong adaptability to complex PIoT environments.

[0090] This embodiment also provides a power Internet of Things anomaly detection system based on granular-spherical intuitionistic fuzzy modeling, including:

[0091] The known category particle generation module is configured to construct multiple training particle intuition fuzzy models corresponding to known category labels based on the known normal and abnormal data of the power Internet of Things, and form a training particle intuition fuzzy set.

[0092] The unknown category particle generation module is configured to construct multiple unknown category intuitionistic fuzzy models of the particles to be tested based on the unknown category data of the power Internet of Things, and form an intuitionistic fuzzy set of the particles to be tested.

[0093] The intuitionistic fuzzy distance calculation module is configured to calculate the fuzzy distance between each intuitionistic fuzzy model of the test particle intuitionistic fuzzy set and all training particle intuitionistic fuzzy models in the training particle intuitionistic fuzzy set.

[0094] The known category label assignment module is configured to assign the known category label of the training particle-sphere intuitionistic fuzzy model that has the smallest fuzzy distance to the particle-sphere intuitionistic fuzzy model under test to the unknown category data corresponding to the particle-sphere intuitionistic fuzzy model under test.

[0095] The anomaly detection output module is configured to determine whether the known category label assigned to unknown category data is an anomaly label; if not, the unknown category data is determined to be normal data; if so, the unknown category data is determined to be anomaly data, and a structured alarm message is generated.

[0096] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A power Internet of Things anomaly detection method based on particle-spherical intuitionistic fuzzy modeling, characterized in that, Includes the following steps: S1. Based on the known normal and abnormal data from the power Internet of Things, construct multiple training particle-sphere intuitionistic fuzzy models corresponding to known category labels, and form a training particle-sphere intuitionistic fuzzy set; the specific method is as follows: S11. Collect known normal data and known abnormal data from the power Internet of Things, and preprocess the known normal data and known abnormal data to obtain a dataset; The known normal data and known abnormal data are multi-source heterogeneous data streams from substation monitoring systems, distribution automation terminals, smart meter concentrators and edge gateways. The multi-source heterogeneous data streams include numerical telemetry signals, discrete event logs, communication message fields and timestamp information. The preprocessing includes cleaning, transformation, and normalization. Specifically, missing data values ​​are zero-filled, and non-numerical data is encoded. Then, the numerical characteristics of all data are normalized by minimax; S12. Fit the dataset using a random forest classifier, calculate the importance score of each data feature based on the average impurity when each decision tree node splits, and select the top-ranked data features to obtain the training set. S13. First, divide the training set into multiple independent subsets according to normal and abnormal labels, and then run K-means clustering on each subset separately to generate multiple training particles. S14. Using the geometric center of each training particle as a reference point, calculate the membership degree, non-membership degree, and hesitation degree of the training particle based on the distance of all data in the training particle to the geometric center, in order to construct the training particle intuition fuzzy model corresponding to the category label and form the training particle intuition fuzzy set. S2. Using the training particle-sphere intuitionistic fuzzy set as a reference, construct multiple unknown-category particle-sphere intuitionistic fuzzy models to be tested based on the unknown-category data of the power Internet of Things, and form the unknown-category particle-sphere intuitionistic fuzzy set; the specific method is as follows: S21. Collect unknown category data from the power Internet of Things, and clean, transform, and normalize the unknown category data to obtain the dataset to be tested. S22. Using the training particle intuition fuzzy set as a reference, construct multiple unknown categories of particle intuition fuzzy models to be tested, and form a particle intuition fuzzy set to be tested. S3. Calculate the fuzzy distance between each test particle intuitionistic fuzzy model in the test particle intuitionistic fuzzy set and all training particle intuitionistic fuzzy models in the training particle intuitionistic fuzzy set. S4. Assign the known category label corresponding to the training particle-sphere intuitionistic fuzzy model with the smallest fuzzy distance to the particle-sphere intuitionistic fuzzy model to the unknown category data corresponding to the particle-sphere intuitionistic fuzzy model to be tested. S5. Determine whether the known category label assigned to the unknown category data is an abnormal label; If not, then the unknown category data is determined to be normal data; if yes, then the unknown category data is determined to be abnormal data, and a structured alarm message is generated. The structured alarm information includes anomaly label information, confidence level, attributes of the training particle-sphere intuitionistic fuzzy model most similar to the anomaly data, and key explanatory fields.

2. The power Internet of Things anomaly detection method based on particle-sphere intuitionistic fuzzy modeling according to claim 1, characterized in that, In step S12, the top 10 to 20 most important data features are selected to form a training set.

3. The power Internet of Things anomaly detection method based on particle-sphere intuitionistic fuzzy modeling according to claim 1, characterized in that, The key explanatory fields include the device number from which the abnormal data originated and the device's operating time.

4. The power Internet of Things anomaly detection method based on particle-sphere intuitionistic fuzzy modeling according to claim 1, characterized in that, The structured alarm information is simultaneously pushed to the power monitoring master station platform.

5. A power Internet of Things (IoT) anomaly detection system based on granular-spherical intuitionistic fuzzy modeling, used to implement the power IoT anomaly detection method based on granular-spherical intuitionistic fuzzy modeling as described in claim 1, characterized in that, include: The known category particle generation module is configured to construct multiple training particle intuition fuzzy models corresponding to known category labels based on the known normal and abnormal data of the power Internet of Things, and form a training particle intuition fuzzy set. The unknown category particle generation module is configured to construct multiple unknown category intuitionistic fuzzy models of the particles to be tested based on the unknown category data of the power Internet of Things, and form an intuitionistic fuzzy set of the particles to be tested. The intuitionistic fuzzy distance calculation module is configured to calculate the fuzzy distance between each intuitionistic fuzzy model of the test particle intuitionistic fuzzy set and all training particle intuitionistic fuzzy models in the training particle intuitionistic fuzzy set. The known category label assignment module is configured to assign the known category label of the training particle-sphere intuitionistic fuzzy model that has the smallest fuzzy distance to the particle-sphere intuitionistic fuzzy model under test to the unknown category data corresponding to the particle-sphere intuitionistic fuzzy model under test. The anomaly detection output module is configured to determine whether the known category label assigned to unknown category data is an anomaly label; If not, then the unknown category data is determined to be normal data; If so, the unknown category data is identified as abnormal data, and a structured alarm message is generated.

Images