A Smart Method and System for Identifying Electricity Theft Behavior of Low-Voltage Residential Users Based on Large Language Models

Abstract

This invention provides an intelligent method for identifying electricity theft by low-voltage residential users based on a large language model, belonging to the field of power system electricity consumption behavior analysis and electricity inspection technology. The method includes: S1: multi-source heterogeneous data full-dimensional collection and standardized preprocessing; S2: abnormal electricity consumption detection; S3: knowledge enhancement and candidate user expansion; S4: large language model-assisted identification and interpretation generation. It also provides an intelligent system for identifying electricity theft by low-voltage residential users based on a large language model, including a data collection and processing module, a low-dimensional feature vector generation module, a suspected abnormal user list composition module, a candidate user list formation module, an attention weight calculation module, and an electricity theft identification result generation module. This invention constructs a collaborative optimization mechanism for knowledge and models, transforming anti-electricity theft regulations and case experience into a reasonable knowledge base and rule base, realizing the full-link connection of data—knowledge—rules—identification.

Description

Technical Field

[0001] This invention relates to the field of power system electricity consumption behavior analysis and electricity consumption inspection technology, specifically to a method and system for intelligently identifying electricity theft behavior of low-voltage residential users based on a large language model. Background Technology

[0002] With the deepening construction of new power systems and ubiquitous power Internet of Things, the coverage rate of smart meters for low-voltage residential users has approached 100%, and massive amounts of high-frequency electricity consumption data provide a data foundation for detecting electricity theft. Current research on electricity theft detection in the industry mainly focuses on three directions: first, the application of machine learning / deep learning methods based on electricity consumption curves, such as deep neural networks, convolutional neural networks, and autoencoders; second, multi-source feature fusion techniques based on federated learning and transfer learning to alleviate data silos and class imbalance problems; and third, exploration of interpretable discrimination through human-machine collaboration, attempting to improve the practical adaptability of model results.

[0003] However, existing technologies still have four major pain points, making it difficult to meet the actual business needs of power grid companies:

[0004] The data utilization is limited: the identification of electricity theft mainly relies on structured electricity consumption data (such as load curves and electricity consumption), while ignoring a large amount of unstructured text data such as on-site investigation records, inspection records, customer service work orders, complaints and reports, and feedback information. This results in a limited ability to identify complex electricity theft methods such as concealment, intermittency, and gang activity.

[0005] The disconnect between knowledge and models: The knowledge accumulated by power grid companies, such as anti-electricity theft regulations, typical cases, and inspection experience, lacks a unified expression and automatic reasoning mechanism with machine learning models. Rules cannot dynamically adapt to model output, and models also have difficulty absorbing practical experience.

[0006] Insufficient interpretability: Existing methods mostly provide only anomaly scores or a small amount of feature contribution information, which cannot generate natural language interpretations and complete evidence chains that conform to the logic of investigators and meet the requirements of judicial evidence. The model results are difficult to directly support case filing, recovery and judicial appraisal.

[0007] Poor business adaptability: There is a lack of a large-scale, end-to-end integrated solution for low-voltage residential users. An integrated technical solution for data collection, anomaly detection, risk assessment, on-site verification, and case closure has not yet been formed, making integration with existing marketing systems and electricity information collection systems quite difficult.

[0008] The rapid development of large language models provides a new path to solve the above problems. Its advantages in semantic understanding of multi-source heterogeneous data, knowledge extraction, and reasoning generation are expected to break down the barriers between structured and unstructured data, achieve synergistic optimization of knowledge and models, and improve the accuracy and interpretability of electricity theft detection. Summary of the Invention

[0009] This invention provides a method and system for intelligently identifying electricity theft by low-voltage residential users based on a large language model, in order to solve one or more of the problems mentioned above.

[0010] A smart method for identifying electricity theft by low-voltage residential users based on a large language model includes:

[0011] S1: Collect structured data from low-voltage residential users, including electricity consumption data, transformer operation data, and basic user information, as well as unstructured text data, including historical case files of anti-electricity theft, inspection records, customer service work orders, complaint and report texts, and feedback information. Then, clean, de-identify, standardize, and label the data to form an analysis dataset, a set of text features, and a basic user profile.

[0012] S2: Multi-kernel local preservation projection is used to perform feature dimensionality reduction on the structured data in the analysis dataset to generate low-dimensional feature vectors; the low-dimensional feature vectors are input into an adaptive weighted isolation forest to calculate the anomaly score and anomaly contribution of each user, and users whose anomaly scores reach the set threshold are selected to form a list of suspected anomaly users.

[0013] S3: Call the pre-built electricity theft knowledge base, retrieve historical electricity theft cases similar to the low-dimensional feature vectors of suspected abnormal users, extract the features of related users, combine the anti-electricity theft rule base to perform rule matching on the related users in the transformer area where the suspected abnormal user is located, filter the related users that meet the rules, and merge them with the list of suspected abnormal users to form a candidate user list.

[0014] S4: Construct a three-layer heterogeneous graph of user-feature-knowledge, and adopt a dual-attention graph neural collaborative reasoning algorithm to integrate the low-dimensional feature vectors of candidate users, user basic profiles, text feature sets and electricity theft knowledge base information, and calculate node attention weights and relation attention weights; then adopt an evidence chain weighted Bayesian reasoning algorithm to allocate evidence weights based on node attention weights and relation attention weights, integrate abnormal score evidence, feature matching evidence, text semantic evidence, and rule matching evidence, calculate the posterior probability of electricity theft of candidate users and evidence confidence, determine the risk level and generate a structured analysis report containing key abnormal evidence, suspected electricity theft methods, and suggested verification measures;

[0015] S5: Push the structured analysis report to the inspectors to conduct on-site verification, record the verification results, new evidence and processing results, and form a standardized feedback dataset;

[0016] S6: The standardized feedback dataset is fed back to the electricity theft knowledge base for updating. At the same time, the feedback data is used as new samples to iteratively optimize the model parameters of multi-core local preservation projection, adaptive weighted isolated forest, dual attention map neural collaborative reasoning, and evidence chain weighted Bayesian reasoning, so as to achieve continuous iteration of knowledge and model.

[0017] In this specification, the labeling processing of unstructured text data in S1 specifically includes: performing semantic parsing on unstructured text data through a large language model, extracting keywords, event elements and semantic tendencies related to electricity theft, mapping the text data into a fixed-dimensional vector representation, and generating a set of text features by combining text source type tags; among which, event elements include descriptions of electricity theft methods, mentions of evidence types, statements related to processing results and core content of user demands.

[0018] In this specification, the process of multi-kernel local preservation projection is as follows: multiple heterogeneous kernel functions are fused, a neighborhood graph is constructed by calculating the kernel distance between structured data of different users, a Laplacian matrix is ​​generated based on the neighborhood graph, and an objective function is constructed by combining the anomaly contribution, the feedback node attention weight and the evidence confidence to minimize the local structure loss after the high-dimensional data is projected. The projection matrix is ​​obtained by solving the objective function, and the high-dimensional structured data is mapped into a low-redundancy low-dimensional feature vector through the projection matrix.

[0019] In this specification, the process of adaptive weighted isolation forest is as follows: the initial sample weights are calculated based on the variance of the low-dimensional feature vectors; multiple isolation trees are integrated to randomly split the samples, and the path length of each user sample in each isolation tree is recorded; the accuracy weight is calculated by combining the detection accuracy of each isolation tree; the anomaly score is calculated by weighting the path length and accuracy weight; and the anomaly contribution is obtained by fusing the anomaly score, the low-dimensional feature variance, and the feedback posterior probability of electricity theft, and then normalizing the result.

[0020] In this specification, the process of dual-attention graph neural collaborative reasoning is as follows: the user node feature vector is composed of low-dimensional feature vector, user basic profile feature vector, text feature vector and anomaly contribution vector; the feature vectors of feature nodes and knowledge base nodes are composed of the semantic representation and association strength features of the corresponding data; the node attention weight is calculated by fusing the node feature vector, evidence confidence and anomaly contribution, and the relation attention weight is calculated by fusing the edge type encoding and the similarity of the corresponding node's low-dimensional features; the feature vectors of the user node are updated by fusing the features of the neighboring nodes and the dual attention weights through graph convolution operations to strengthen the representation of key information.

[0021] In this specification, the weighted Bayesian inference process is as follows: Anomaly score evidence directly uses the anomaly score output by an adaptive weighted isolated forest; feature matching evidence calculates the similarity between the candidate user's low-dimensional feature vector and the low-dimensional feature vector of historical electricity theft cases, taking the maximum value as the feature matching evidence value; textual semantic evidence is obtained by calculating the average similarity between the text feature vector and the electricity theft keyword vector library using a large language model; rule matching evidence is obtained by statistically analyzing the percentage of candidate users who satisfy predefined rules in the anti-electricity theft rule library; weights are assigned to each piece of evidence based on the product of node attention weights and relational attention weights, and the weighted Bayesian formula is used to calculate the posterior probability of electricity theft. The evidence confidence is then obtained by combining the likelihood ratio and the maximum similarity of feature matching.

[0022] In this specification, S2 and S4 have bidirectional interaction logic: the multi-kernel local preservation projection receives the node attention weights from the dual attention map neural collaborative reasoning output and the evidence confidence from the evidence chain weighted Bayesian reasoning output, and dynamically adjusts the kernel function weighting coefficients and projection matrix; the dual attention map neural collaborative reasoning receives the low-dimensional feature vectors from the multi-kernel local preservation projection output and the anomaly contribution from the adaptive weighted isolated forest output, and optimizes the calculation of node and relation attention weights; the evidence chain weighted Bayesian reasoning receives the low-dimensional feature vectors from the multi-kernel local preservation projection output and the anomaly scores from the adaptive weighted isolated forest output, and adjusts the evidence weight allocation and likelihood probability parameters; each interaction terminates when the parameter change is below a set threshold or when a set number of iterations is reached.

[0023] In this specification, there is an interactive logic between multi-kernel local preservation projection and adaptive weighted isolation forest: multi-kernel local preservation projection inputs the generated low-dimensional feature vector into adaptive weighted isolation forest, providing a basis for calculating anomaly scores and anomaly contributions; adaptive weighted isolation forest feeds back the output anomaly contribution to multi-kernel local preservation projection, which is used to adjust the kernel function weighting coefficients and the optimization direction of the objective function, thereby improving the ability of low-dimensional feature vectors to represent anomaly patterns; the interaction ends when the change in the kernel function weighting coefficients is lower than a set threshold or the number of iterations reaches a set value.

[0024] In this specification, there is an interactive logic between dual-attention graph neural collaborative reasoning and evidence chain weighted Bayesian reasoning: dual-attention graph neural collaborative reasoning inputs the calculated node attention weights and relation attention weights into evidence chain weighted Bayesian reasoning as the core basis for evidence weight allocation; evidence chain weighted Bayesian reasoning feeds back the output evidence confidence level to dual-attention graph neural collaborative reasoning to adjust the calculated weights of node and relation attention weights; through interaction, the representation and utilization of key evidence are strengthened, and the accuracy of calculating the posterior probability of electricity theft is improved. The interaction ends when the change in attention weights is lower than a set threshold or the set number of iterations is reached.

[0025] The intelligent identification system for electricity theft by low-voltage residential users based on a large language model includes the following modules:

[0026] The data acquisition and processing module is used to collect structured data from low-voltage residential users, including electricity consumption data, transformer operation data, and basic user information, as well as unstructured text data, including anti-electricity theft historical case files, inspection records, customer service work orders, complaint and report texts, and feedback information. The data is then cleaned, desensitized, standardized, and tagged to form an analysis dataset, a text feature set, and a basic user profile.

[0027] The low-dimensional feature vector generation module is used to perform feature dimensionality reduction on the structured data in the analysis dataset using multi-kernel local preservation projection to generate low-dimensional feature vectors.

[0028] The suspected abnormal user list composition module is used to input low-dimensional feature vectors into the adaptive weighted isolation forest, calculate the abnormal score and abnormal contribution of each user, and filter users whose abnormal scores reach a set threshold to form a suspected abnormal user list.

[0029] The candidate user list formation module is used to call a pre-built electricity theft knowledge base, retrieve historical electricity theft cases that are similar to the low-dimensional feature vectors of suspected abnormal users, extract the features of related users, combine the anti-electricity theft rule base to perform rule matching on the related users in the transformer area where the suspected abnormal user is located, filter out the related users that meet the rules, and merge them with the suspected abnormal user list to form a candidate user list.

[0030] The attention weight calculation module is used to construct a three-layer heterogeneous graph of user-feature-knowledge. It adopts a dual attention graph neural collaborative reasoning algorithm, which integrates the low-dimensional feature vectors of candidate users, user basic profiles, text feature sets and electricity theft knowledge base information, and calculates node attention weights and relation attention weights.

[0031] The electricity theft detection result generation module is used to further employ the evidence chain weighted Bayesian inference algorithm, allocate evidence weights based on node attention weights and relation attention weights, integrate abnormal score evidence, feature matching evidence, text semantic evidence, and rule matching evidence, calculate the posterior probability of electricity theft for candidate users and the confidence level of evidence, determine the risk level, and generate a structured analysis report containing key abnormal evidence, suspected electricity theft methods, and suggested verification measures.

[0032] The embodiments in this specification can achieve at least the following beneficial effects: Significantly improved discrimination accuracy: The four algorithms interact and collaborate in pairs, overcoming the limitations of a single algorithm. Anomaly detection accuracy is ≥90%, electricity theft recall rate is ≥85%, and false alarm rate is ≤5%. The ability to identify covert and organized electricity theft is improved by more than 40% compared to traditional methods. Enhanced interpretability and practical adaptability: By combining a large language model with Bayesian inference, a natural language analysis report and a complete chain of evidence are generated. The report directly supports case filing, recovery, and forensic identification, improving the efficiency of work order processing for inspectors by more than 50%. Full utilization of multi-source data: The integration of structured and unstructured data covers multiple dimensions such as electricity consumption behavior, textual clues, and knowledge rules. The system boasts several key features: 1) Enhanced accuracy: 35% higher recognition rate for complex scenarios such as intermittent electricity theft and theft through social connections; 2) Seamless integration with business processes: Standardized interfaces and processes allow direct integration into existing power grid marketing systems, electricity consumption information collection systems, and anti-theft inspection systems, eliminating the need to restructure existing business lines and reducing deployment costs by 30%; 3) Outstanding continuous iteration capabilities: A closed-loop update mechanism enables the system to automatically absorb new electricity theft methods and inspection experience, with monthly updates improving model adaptability by over 10% and maintaining industry-leading discrimination performance; 4) Data security and compliance: Supports private deployment, combined with data anonymization and federated learning technologies to meet the data privacy and compliance requirements of electricity customers, eliminating the risk of data leakage. Attached Figure Description

[0033] Figure 1 This is a flowchart illustrating an intelligent method for identifying electricity theft by low-voltage residential users based on a large language model.

[0034] Figure 2 This is a schematic diagram of the overall technical process involved in this invention.

[0035] Figure 3 This is a schematic diagram of the technical process before interaction of the S2 algorithm involved in this invention.

[0036] Figure 4 This is a schematic diagram of the technical process after the interaction of the S2 algorithm involved in this invention.

[0037] Figure 5 This is a schematic diagram of the framework of an intelligent system for identifying electricity theft by low-voltage residential users based on a large language model. Detailed Implementation

[0038] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0039] like Figure 1 and Figure 2 As shown in the figure, this embodiment provides an intelligent method for identifying electricity theft behavior of low-voltage residential users based on a large language model, as detailed below:

[0040] S1: Multi-source heterogeneous data collection and standardized preprocessing; comprehensively collect structured electricity consumption data and unstructured text data of low-voltage residential users, eliminate data noise, unify data format, and ensure data security and compliance through systematic preprocessing to form a high-quality analysis dataset, provide clean input features for subsequent anomaly detection models, lay the data foundation for knowledge extraction and comprehensive judgment, and ensure the accuracy and consistency of data transmission throughout the entire process.

[0041] Structured data acquisition: Accurately extract full measurement data of low-voltage residential users from the electricity information collection system, covering core electricity consumption indicators such as metering cycle electricity consumption, daily load curve, hourly load curve, 15-minute load curve, current, voltage, active power, reactive power, power factor, and demand; obtain basic user information from the marketing business system, including identity and electricity attribute information such as name, detailed address, electricity category, and account opening time, as well as electricity behavior-related data such as payment records, arrears information, and electricity change records; collect data reflecting the overall operating status of the transformer area, such as total load, line loss, three-phase imbalance, and transformer operating temperature, from the transformer area monitoring system. These data together constitute the structured feature basis of user electricity consumption behavior.

[0042] Unstructured text data collection: Retrieve textual materials with legal and factual basis, such as historical case files of anti-electricity theft, on-site investigation records, electricity inspection records, and handling decisions, from the audit system; obtain customer service work orders and transcripts of user call recordings from the customer service system to capture user inquiries, requests, and abnormal feedback during electricity use; collect user complaint texts and report information from complaint and reporting channels to uncover potential clues to electricity theft; obtain feedback texts related to low-voltage residential electricity use from compliant and authorized public feedback platforms to expand the breadth of data sources and ensure that no unstructured information that may reflect electricity theft is overlooked.

[0043] Structured data processing: For missing values ​​in the measurement data, mean imputation is used. This involves calculating the mean of the indicator within the same time frame and user group to replace missing data, ensuring data integrity. Outliers are removed using the 3σ principle. Specifically, the mean μ and standard deviation σ of the indicator are calculated, and data exceeding the range of μ-3σ to μ+3σ are identified and removed to avoid interference from outliers in subsequent model training. Time alignment is performed on load curves at different time granularities to uniformly adjust them to 15-minute intervals, ensuring data consistency across time dimensions and facilitating subsequent time-series feature analysis. Temperature data for the corresponding time periods is obtained through public interfaces from meteorological departments, and holiday and seasonal markers are added using calendar information to enrich the external correlation features of the data. Finally, all structured data is integrated and correlated according to user identifier, station area identifier, and time axis to form a data structure with the following dimensions: Time series data matrix , where represents the number of users, represents the feature dimension, and each element corresponds to the -th user's -th feature value.

[0044] Unstructured text data processing: First, perform privacy desensitization processing on all text data, hiding sensitive information such as user ID numbers, mobile phone numbers, and detailed addresses to ensure user privacy security; then, perform sentence segmentation according to punctuation marks and paragraph segmentation according to logical semantics to make the text structure clearer; use the TF-IDF denoising method to remove meaningless stop words, including words such as "de", "le", "zai", "he" that do not contribute actual semantic meaning, and retain the core information; finally, perform tagging on the processed text to clearly mark the source of each piece of text, that is, inspection records, customer service work orders, complaint reports, or feedback information, to form a text feature set , where is the -th user's text feature vector, and each dimension of the vector corresponds to the key semantic features extracted from the text.

[0045] Output results: After preprocessing, output the time series data matrix , the text feature set and the user base portrait , where contains the basic information and historical electricity consumption statistical values of the -th user. These results will directly serve as the core input data for subsequent S2 anomaly detection and S4 comprehensive research and judgment, ensuring the effective circulation and utilization of data throughout the process.

[0046] S2: Abnormal electricity consumption detection; for the high-dimensional time series data output by S1 , fuse two efficient algorithms, multi-core locally preserving projection and adaptive weighted isolation forest, to construct a collaborative and interactive anomaly detection model. At the same time, these two algorithms interact pairwise with the dual-attention graph neural collaborative reasoning and evidence-chain weighted Bayesian reasoning of S4 respectively, and optimize the model parameters through multi-directional data feedback. Multi-core locally preserving projection focuses on feature dimensionality reduction and local structure preservation of high-dimensional data, solves the dimensionality disaster problem of high-dimensional time series data, and provides low-redundancy and high-discriminability core features for the other three algorithms; adaptive weighted isolation forest realizes accurate anomaly score calculation based on low-dimensional features, and at the same time dynamically optimizes its own and other algorithms' key parameters through multi-directional feedback; through the deep pairwise interaction and closed-loop optimization of the four algorithms, significantly improve the recognition accuracy and robustness of abnormal electricity consumption behaviors, and screen out suspected abnormal users. The process before and after interaction is shown in Figure 3 and Figure 4 .

[0047] The core design idea of ​​multi-kernel local preservation projection is to fully capture the linear and nonlinear local structural information in high-dimensional time-series data by integrating the advantages of multiple kernel functions. This achieves feature dimensionality reduction while preserving, to the greatest extent possible, the abnormal structural features related to electricity theft. This model not only interacts directly with adaptive weighted isolated forests but also receives dual-path feedback from node attention weights in dual-attention map neural collaborative inference and evidence confidence scores in evidence chain-weighted Bayesian inference. It dynamically adjusts the kernel function weighting coefficients and projection matrix, making the dimensionality reduction process more aligned with the needs of the entire analysis process and ensuring that low-dimensional features can effectively support the computation of all subsequent algorithms.

[0048] 1. Kernel Function Definition: To comprehensively cover different structural features of the data, three complementary kernel functions are selected, as follows: Polynomial Kernel: ,in and These are time series data matrices. The first in The and the first High-dimensional feature vectors of individual users This is the offset, used to adjust the range of values ​​for the kernel function. The polynomial degree is specified; a cubic polynomial is chosen because the nonlinear relationships in electricity consumption data are mostly concentrated within the third order, which captures complex correlations without overfitting. Gaussian kernel: ,in for and The square of the Euclidean distance, The bandwidth parameter, determined through calibration using historical data, can accurately capture the local density distribution characteristics of electricity consumption data. Sigmoid core: ,in For the slope parameter, Using the intercept parameter, this kernel function has activation characteristics similar to those of a neural network, enabling it to uncover complex nonlinear correlations hidden in electricity consumption data.

[0049] 2. Kernel function weighting coefficients: Let the kernel function weighting coefficient vector be... ,satisfy and This coefficient is used to balance the contributions of the three kernel functions in feature extraction. The initial value is set to... Subsequently, the kernel function fusion will be dynamically adjusted in multiple directions based on the anomaly contribution of the adaptive weighted isolated forest, the node attention weight of the dual attention graph neural collaborative reasoning, and the evidence confidence of the evidence chain weighted Bayesian reasoning, so that the kernel function fusion can better meet the needs of the entire process of anomaly detection and judgment.

[0050] 3. Adjacency Matrix Construction: To preserve the local neighborhood relationships of data, for each user... Based on kernel distance Build -Nearest neighbor graph, where This means that each user is associated only with the 10 most similar users in the feature space. Adjacency matrix Defined as: when user User of -When neighboring, ,otherwise This matrix can clearly depict the local relational structure of users in the feature space.

[0051] 4. Objective Function: The objective of multi-kernel local preservative projection is to find a low-dimensional projection matrix. ( (To minimize the feature dimension), so that the projected data can both preserve the local structure of the original data and highlight anomalous features. The objective function is designed as follows: ;in: It is the identity matrix; For Laplace matrix, It is a diagonal matrix and The Laplace matrix can effectively characterize the global structure of data; , , The regularization parameters are used to balance the weights of the adaptive weighted isolated forest feedback term, the dual attention map neural collaborative reasoning feedback term, and the evidence chain weighted Bayesian reasoning feedback term, respectively. The first output of the adaptive weighted isolated forest The abnormal contribution score for each user, with a value range of [value range missing]. The larger the value, the more significant the user's abnormal characteristics; Feature nodes output for dual-attention graph neural collaborative reasoning Attention weights; The first output of the weighted Bayesian inference for the chain of evidence Class of evidence corresponding to feature nodes The confidence level is increased. By introducing three feedback signals into the objective function, the learning process of the projection matrix can simultaneously focus on users with prominent abnormal characteristics, high-importance feature nodes, and high-confidence evidence nodes, significantly improving the targeting and effectiveness of dimensionality reduction.

[0052] Model training process: 1. First, input the time series data matrix of S1. and initialize the kernel function weighting coefficients. This provides the initial parameter base for model training. 2. A training set is constructed by selecting 5000 historically labeled normal electricity consumption samples and 1000 electricity theft samples. This sample set covers different electricity consumption scenarios and different types of electricity theft, ensuring the representativeness of the training data. Based on the training set, the kernel distance is calculated and an adjacency matrix is ​​generated according to the adjacency matrix construction method described above. And then through ( , Construct the Laplace matrix for the number of training set samples. 3. Solving the generalized eigenvalue problem corresponding to the objective function. ,in Let be the eigenvalues. The Jacobi iteration method is used to solve this generalized eigenvalue problem, taking the first eigenvalues... The eigenvectors corresponding to the smallest eigenvalues ​​form the initial projection matrix. At this point, the projection matrix has not yet considered the three-way feedback signals; it is only based on the global and local structure of the data for learning. 4. Initiate pairwise interactive training with the other three algorithms: Interaction with Adaptive Weighted Isolation Forest: Call the initially trained Adaptive Weighted Isolation Forest model to project the low-dimensional features of the training set. Perform anomaly scoring to obtain the anomaly contribution of each training sample. Interacting with dual-attention map neural collaborative reasoning: initial low-dimensional features Input a dual-attention map neural collaborative reasoning model and obtain the attention weights of feature nodes. Interacting with evidence chain-weighted Bayesian inference: transforming initial low-dimensional features Feature matching evidence calculation for weighted Bayesian inference of evidence chains, obtaining evidence confidence. 5. Based on the three feedback signals, update the kernel function weighting coefficients using the following formula: ;in To train a centralized set of electricity theft samples, This represents the number of electricity theft samples. Let be the mean vector of the electricity theft samples. The number of feature nodes. , , These are the weighting coefficients for the three feedback signals. This represents the number of iterations. The core idea of ​​this update formula is to comprehensively consider the distinguishing abilities of the three kernel functions on outlier samples, high-importance feature nodes, and high-confidence evidence nodes, and assign higher weights to the kernel function that performs better. 6. Set the interaction termination condition: When the kernel function weighting coefficient... The weight update stops when the iteration change is less than 0.001, or when the number of iterations reaches 3. If the termination condition is not met, return to step 3 and use the updated weight. Recalculate the kernel distance, adjacency matrix, and Laplacian matrix; solve the generalized eigenvalue problem again; and update the projection matrix. 7. When the interaction termination condition is met, the final training projection matrix is ​​obtained. At this point, the projection matrix has fully integrated the three feedback signals, enabling it to extract low-dimensional features related to electricity theft more accurately.

[0053] Model application process: The time series data matrix of S1... The fully trained multi-kernel local preserving projection model is input and processed through the final projection matrix. Linear projection of high-dimensional features generates low-dimensional feature vectors: ;in , For the first The low-dimensional feature vectors of each user, with dimensions ranging from... Down to This effectively reduces data redundancy and the computational complexity of subsequent models. The low-dimensional feature vector fully preserves the key structural information related to electricity theft in the original data and will be output to three algorithms: adaptive weighted isolated forest, dual attention map neural collaborative reasoning, and evidence chain weighted Bayesian reasoning, providing them with high-quality input features.

[0054] Core Role and Contribution: Multi-kernel local preservation projection, as the core algorithm for feature preprocessing throughout the entire process, solves the problem that traditional dimensionality reduction algorithms can only handle single types of data and lack multi-directional feedback optimization mechanisms. By integrating three kernel functions, it takes into account both the linear and nonlinear structural characteristics of electricity consumption data, avoiding the deficiency of a single kernel function in fully capturing complex electricity consumption patterns. By introducing feedback signals from the other three algorithms, the dimensionality reduction process can accurately focus on key information. The generated low-dimensional features not only meet the needs of anomaly detection but also support subsequent knowledge fusion and probabilistic reasoning, achieving efficient feature supply with one-time dimensionality reduction and multi-directional support, laying a core foundation for improving the overall discrimination accuracy.

[0055] Adaptive Weighted Isolation Forest is an improved algorithm based on the traditional Isolation Forest algorithm. It integrates multiple isolated trees to detect anomalies in low-dimensional features. The core innovation lies in introducing sample weights to adaptively adjust the splitting strategy of the isolated trees, making the model pay more attention to high-risk samples. This model not only interacts directly with multi-kernel local preservation projection, but also receives dual-path feedback from relational attention weights of dual-attention map neural collaborative inference and posterior probability from evidence chain weighted Bayesian inference. It dynamically adjusts the precision weights of isolated trees and sample weights, and simultaneously outputs anomaly scores and anomaly contribution values ​​to the other three algorithms, achieving deep collaborative optimization of the four algorithms.

[0056] 1. Isolated tree structure: The model consists of... An isolated tree ( The system is composed of multiple isolated trees, each of which is a binary tree structure. Leaf nodes store the sample set, and internal nodes store the split feature index. With split threshold The core idea of ​​isolation trees is to use random splitting features to isolate anomalous samples to leaf nodes more quickly, with a shorter path length than normal samples.

[0057] 2. Sample weight definition: To enable the model to focus on potential outliers, a sample weight vector is defined. ,in , , These are the weighting coefficients. For the first Low-dimensional feature vectors of individual users variance The first output of the weighted Bayesian inference for the chain of evidence The posterior probability of a user stealing electricity. The larger the variance, the more significant the difference between the user's electricity consumption characteristics and those of other users. The higher the posterior probability, the greater the suspicion that the user is stealing electricity. Therefore, these samples are given higher weights so that they receive more attention during the splitting process of the isolation tree.

[0058] 3. Anomaly Score Formula: For the first... Each user, with their abnormal score It is calculated by weighting the path lengths of all isolated trees, with the weight being the detection accuracy of each isolated tree. Furthermore, this precision weight is adjusted by the relational attention weight of the dual-attention map neural collaborative reasoning, as shown in the following formula: ;in: For the first Low-dimensional characteristics of individual users In the An isolated tree The path length in the equation is the number of edges traversed from the root node to the leaf node. The average path length of normal samples. It is a harmonic number and , This is the Euler constant, a parameter used to normalize the path length; For the first The basic accuracy of an isolated tree The true positive rate (the proportion of correctly identified electricity theft samples out of the actual number of electricity theft samples). The false positive rate (the proportion of normal samples that were incorrectly identified as electricity theft out of the actual number of normal samples); The output of the dual attention map neural collaborative reasoning is related to the first The average relational attention weight of the edges associated with isolated trees; This represents the influence coefficient of the relational attention weight. By introducing relational attention weights to adjust the accuracy weights of isolated trees, isolated trees associated with edges of high importance have a higher weight in the final score calculation, thus improving the model's sensitivity to key relational features.

[0059] 4. Calculation of Abnormal Contribution: Abnormal Contribution Used to reflect the The degree to which a user's anomalous features affect other algorithms is jointly determined by the anomaly score, the variance of low-dimensional features, and the posterior probability, as shown in the following formula: This formula, through normalization, ensures that the range of abnormal contribution values ​​is within a certain range. arrive Among them, users with higher anomaly scores, larger feature variances, and higher posterior probabilities have a higher anomaly contribution and a greater impact on the adjustment of other algorithm parameters.

[0060] Model training process: 1. Input the low-dimensional features of the training set that are the output of the multi-kernel local preservation projection. With corresponding label ,in This represents a sample of electricity theft. This represents a normal electricity consumption sample, providing supervised information for model training. 2. Initialize the sample weight vector. Isolation Tree Precision Weights ( , (Set the number of iterations for the basic accuracy metric of the initial isolated tree) Iteration change threshold 3. Initiate pairwise interactive training with the other three algorithms: Multi-kernel local preservation projection interaction: Adjust initial sample weights Kernel function weight updates for multi-kernel local preserving projection, receiving optimized low-dimensional features from its output. Interacting with dual attention maps for neural collaborative reasoning: Input a dual-attention graph neural collaborative reasoning model and obtain the average relational attention weights of the edges associated with each isolated tree. Interacting with evidence chain-weighted Bayesian inference: Initial anomaly scores (based on...) (Calculation) is used as evidence of anomalies and input into the evidence chain weighted Bayesian inference model to obtain the posterior probability of electricity theft for each sample. 4. For each isolated tree According to the updated sample weights Weighted sampling is performed, meaning that samples with higher weights have a greater probability of being selected. Each sample forms a subset. For each internal node, within the feature value range... Inner uniformly randomly generated split threshold , sort the samples and Split into left and right child nodes until a leaf node contains only one sample or the depth limit is reached. 5. Calculate the updated value of each isolated tree. and , combined Update the precision weights of the isolated tree 6. Calculate the change in sample weights. And the change in precision weights of isolated trees ,like and ,or If the interaction termination condition is met, training should stop; otherwise... Return to step 3 to continue iterating. 7. When the interaction termination condition is met, complete the overall training of the adaptive weighted isolated forest model and determine the final sample weights, isolated tree precision weights, and isolated tree structure.

[0061] Model application process: 1. All user low-dimensional features output by multi-kernel local preservation projection. Input the trained adaptive weighted isolation forest model, and output the low-dimensional feature vector of each user. Input 100 isolated trees respectively Traverse the splitting path of each isolated tree and record... Path length from root node to leaf node 2. Substitute the values ​​into the anomaly scoring formula, and combine this with the final precision weight of each isolated tree. Average path length compared to normal samples Calculate the anomaly score for each user. The score range is The closer the score is to 1, the higher the probability that the user has engaged in electricity theft. 3. Receive the posterior probability of electricity theft for each user from the weighted Bayesian inference output of the evidence chain. Substitute the values ​​into the abnormal contribution formula to calculate the abnormal contribution of each user. The results are fed back to three algorithms—multi-core local preservation projection, dual-attention map neural collaborative reasoning, and evidence chain weighted Bayesian reasoning—to dynamically adjust their key parameters. 4. Based on statistical analysis of historical audit data, anomaly score thresholds are set. , will abnormal scores Users added to the list of suspected abnormal users This threshold can be further calibrated in subsequent model iterations based on the actual audit results.

[0062] Core Role and Contribution: Adaptive Weighted Isolation Forest, as the core algorithm for anomaly detection, overcomes the limitations of traditional isolation forests, which treat all samples equally and lack multi-source feedback optimization. By introducing a sample weight adaptive mechanism, it focuses on hard-to-distinguish and highly suspicious samples, improving the recall and precision of anomaly detection. By receiving relational attention weights from dual-attention map neural collaborative inference and posterior probabilities from evidence chain-weighted Bayesian inference, it achieves dynamic optimization of isolation tree precision weights and sample weights, enabling the model to quickly adapt to the correlation features of multi-source data. Simultaneously, the output anomaly score and anomaly contribution provide crucial anomaly signal feedback for the other three algorithms, promoting the formation of a collaborative optimization closed loop throughout the entire algorithm process, effectively solving the problems of insufficient robustness and poor generalization ability of single anomaly detection algorithms.

[0063] S3: Knowledge Enhancement and Candidate User Expansion; A list of suspected anomalous users output by S2. low-dimensional feature vectors Abnormal scores With S1 as the core, combined with the user profile of S1 By combining the pre-built electricity theft knowledge base with historical case similarity matching and rule base association matching, we can deeply mine potential related electricity theft users (such as electricity theft gangs in the same area, users related to similar electricity theft methods), expand the scope of candidate users, avoid the problem of missed judgment due to single anomaly detection, and provide a more comprehensive set of candidate users for subsequent comprehensive judgment.

[0064] 1. Knowledge Base Retrieval: The system invokes a pre-built electricity theft knowledge base, which includes core components such as a historical electricity theft case database and an anti-electricity theft rule database. The historical electricity theft case database stores 10,000 closed electricity theft cases from previous years, with each case containing a corresponding low-dimensional feature vector. The system includes key information such as user characteristics, electricity theft methods, and processing results. The anti-electricity theft rule base contains 20 predefined rules, covering the judgment logic for various scenarios such as gang-related electricity theft and covert electricity theft. Examples are as follows: Rule 1: 3 or more people in the same transformer area with an anomaly score ≥ 0.5 → Suspected gang-related electricity theft; Rule 2: User anomaly type consistent with historical gang-related electricity theft cases + association with the same transformer area → Suspected gang-related electricity theft; Rule 3: Anomaly score ≥ 0.7 + textual semantic evidence score ≥ 0.6 → High-risk electricity theft suspicion; Rule 4: Electricity consumption drops by more than 50% for 3 consecutive months. +No reasonable payment record → Suspected electricity theft; Rule 5: Low-dimensional features similar to historical cases of unauthorized wiring ≥0.75 → Suspected electricity theft; Rule 6: Low-dimensional features similar to historical cases of modified meter chips ≥0.7 → Suspected electricity theft; Rule 7: Low-dimensional features similar to historical cases of removed meter seals ≥0.65 → Suspected electricity theft; Rule 8: Low-dimensional features similar to historical cases of altered meter wiring ≥0.6 → Suspected electricity theft; Rule 9: Abnormally high line loss in the transformer area + 3 or more users with abnormal scores ≥0.4 → Gang theft Suspicious electricity theft; Rule 10: User complaint records mentioning slow meter readings + abnormal score ≥ 0.5 → Suspicious electricity theft; Rule 11: Report information pointing to user illegally connecting electrical wires + abnormal score of users in the same area ≥ 0.4 → Suspicious electricity theft; Rule 12: Frequent changes in electricity usage records + abnormal score ≥ 0.55 → Suspicious electricity theft; Rule 13: Overdue payment records exceeding 3 months + abnormal score ≥ 0.5 → Suspicious electricity theft; Rule 14: Abnormal peak value of nighttime load curve + abnormal score ≥ 0.6 → Suspicious electricity theft; Rule 15: Abnormal three-phase imbalance + abnormal user score ≥ 0.45 → Suspected electricity theft; Rule 16: Abnormal transformer operating temperature + abnormal scores of 5 or more users in the distribution area ≥ 0.4 → Suspected gang electricity theft; Rule 17: Text semantic evidence score ≥ 0.5 + rule matching score ≥ 0.5 → Medium to high risk electricity theft; Rule 18: Historical case similarity ≥ 0.6 + abnormal score ≥ 0.5 → Suspected electricity theft; Rule 19: Abnormal scores of all related users at the same address ≥ 0.4 → Suspected electricity theft; Rule 20: No electricity usage change record but sudden change in load curve + abnormal score ≥ 0.6 → Suspected electricity theft.

[0065] List of suspected abnormal users Each user in Calculate its low-dimensional eigenvectors Feature vectors of each case in the historical electricity theft case database Cosine similarity: ;in for and The inner product, and These are the Euclidean norms of the two vectors. The user's vector is calculated using this formula. Historical Cases Feature similarity, filtering similarity Historical cases (this threshold is verified through historical data and can effectively filter out cases with similar electricity theft patterns) are used to extract related user characteristics from these cases, such as users in the same transformer area, users with the same electricity consumption category, and users with the same abnormal type, as clues for discovering potential related electricity theft users.

[0066] 2. Related User Matching: Based on the characteristics of related users obtained from the knowledge base retrieval, suspected abnormal users are first identified. Extract all users within the specified transformer area; then compare these users with suspected abnormal users. The low-dimensional feature vector similarity is used to filter users with a similarity ≥ 0.6; finally, anti-electricity theft rule base matching is performed on these users, verifying whether they meet the above 20 predefined rules one by one, and users who meet any one of the rules are judged as associated users and included in the associated user set. .

[0067] 3. Expand the candidate user list: Expand the list of suspected abnormal users. With associated user set The process involves merging users, removing duplicates, and generating the final list of candidate users. This ensures that no potential electricity thieves are overlooked. Simultaneously, the similarity of historical cases for each candidate user is recorded. The matching results with the rules (specifically, which rules are satisfied) serve as an important basis for subsequent comprehensive judgment.

[0068] 4. Output: Output a list of candidate users. Historical case similarity for each candidate user And the rule matching results, this data will be compared with S1's user base profile. Text feature set S2 abnormal scores low-dimensional feature vectors Abnormal contribution Together they are passed to S4, providing comprehensive and multi-dimensional input data for the large language model's auxiliary discrimination.

[0069] S4: Large language model-assisted discrimination and interpretation generation; it integrates two deep collaborative algorithms—graph neural collaborative reasoning guided by a dual attention mechanism and evidence chain weighted Bayesian reasoning—to integrate multi-source heterogeneous data from S1 to S3, achieving accurate fusion of multi-dimensional features and scientific assessment of electricity theft risks. Simultaneously, these two algorithms interact pairwise with S2's multi-kernel local preservation projection and adaptive weighted isolated forest, respectively, optimizing model parameters through multi-directional data feedback. The dual attention graph neural collaborative reasoning algorithm constructs a three-layer graph structure of user-feature-knowledge, dynamically allocating feature and knowledge weights through a dual attention mechanism to solve the challenge of heterogeneous fusion of multi-source data. The evidence chain weighted Bayesian reasoning algorithm, based on Bayes' theorem, uses the attention weights output by the dual attention graph neural collaborative reasoning as a basis to weightedly fuse multi-source evidence and calculate the posterior probability of electricity theft. Through deep pairwise interaction and collaborative reasoning of the four algorithms, it generates an interpretable assessment report containing risk level, key abnormal evidence, suspected electricity theft methods, and suggested verification measures, providing investigators with accurate and easy-to-understand decision support.

[0070] The core innovation of graph neural collaborative reasoning guided by the dual attention mechanism lies in constructing a three-layer heterogeneous graph structure of user-feature-knowledge. Through the dual mechanisms of node attention and relation attention, it dynamically allocates the importance weights of each node and edge, achieving deep integration of structured features, textual features, and knowledge base knowledge. This model not only interacts directly with evidence chain-weighted Bayesian reasoning, but also receives dual feedback from low-dimensional features that preserve projection in multi-kernel locality and from the anomaly contribution of adaptive weighted isolated forests, dynamically adjusting attention weights. Simultaneously, it outputs node attention weights and relation attention weights to feed back to the other three algorithms, achieving deep collaborative optimization of the four algorithms.

[0071] 1. Graph Structure Definition: Constructing Heterogeneous Graphs , where the node set edge set The specific definition is as follows: Node set: This is a set of candidate user nodes, where each node corresponds to a list of candidate users. A user, node feature vector ,in To preserve the low-dimensional feature vector of the projection output in a multi-kernel local environment, The user profile feature vector output by S1 The text feature vector output by S1 This is the vector of outliers output by the adaptive weighted isolated forest. It is a set of feature nodes, including structured feature nodes (anomaly scores, load curve features, electricity features, etc.) and text feature nodes (complaint keywords, inspection record keywords, etc.). The feature vector of each node is the value or semantic representation of the corresponding feature. This is a set of knowledge base nodes, containing historical case nodes and rule nodes. The feature vector of each node represents the key information of the corresponding case or rule. Edge set: User-feature association edges represent the affiliation relationships between candidate users and each feature node (e.g., user...). It has abnormal score characteristics ); User-knowledge base association edges represent the matching relationships between candidate users and historical case nodes and rule nodes (e.g., user...). Historical Cases (Similarity ≥ 0.7) The feature-knowledge base association edge represents the association between feature nodes and knowledge base nodes (such as the association between abnormal score features and gang electricity theft rules).

[0072] 2. Dual Attention Mechanism: Node Attention: Used to compute attention for each node. Importance weights in graph structures This weighting not only considers the node's own feature vector, but also incorporates the evidence confidence output by the evidence chain weighted Bayesian inference. Anomaly contribution of adaptive weighted isolation forest (For user nodes), the formula is as follows: ;in For nodes eigenvectors, (User node is) ) represents the node attention parameter vector. For the hidden layer dimension, This is a vector concatenation operation; This is the activation function, used to introduce nonlinearity and prevent gradient vanishing. Nodes for weighted Bayesian inference output of the evidence chain The confidence level of the corresponding evidence; User nodes output for adaptive weighted isolated forest Abnormal contribution; normalization using the Softmax function ensures the sum of attention weights for all nodes is 1, guaranteeing the interpretability of the weights. Relational attention: used to calculate the attention of each edge. Association weight The weight is determined by the type of edge. The similarity between low-dimensional features and multi-kernel local preservation projection is determined by the following formula: ;in edge type One-hot encoded vectors, edge types include , , Three categories, therefore It is a 3-dimensional vector; This is the relational attention parameter vector; For nodes The set of adjacent edges; The cosine similarity is the low-dimensional features corresponding to the nodes at both ends of the edge (the low-dimensional features of the associated users correspond to the feature nodes and knowledge nodes). The similarity influence coefficient is calculated using the Softmax function for nodes. The weights of all neighboring edges are normalized so that the sum of the weights of the neighboring edges of the same node is 1.

[0073] 3. Node Feature Update Formula: By fusing the feature information of neighboring nodes with dual attention weights through graph convolution operations, the feature vector of the user node is updated, ensuring that the updated user node features fully reflect the fusion information of multi-source data. The formula is as follows: ;in For user nodes The set of neighboring nodes, including feature nodes and knowledge base nodes associated with the user; For user nodes Node attention weights, For neighboring nodes Node attention weights, For user nodes With neighboring nodes Attention weights related to the edges between them; The graph convolution weight matrix, It is the bias vector; The Sigmoid activation function maps the updated feature vector values ​​to between 0 and 1, enhancing the non-linear expressive power of the features.

[0074] Model training process: 1. Input training data: feature vectors of candidate user nodes Feature vectors of feature nodes, feature vectors of knowledge base nodes, and edge type labels (marking the type of each edge). , or ), and historical verification result tags ( This indicates confirmation of electricity theft. (This indicates false positives), ensuring the comprehensiveness of training data and the effectiveness of supervisory information. 2. Initialize model parameters: Node attention parameter vector. Relational attention parameter vector Graph convolution weight matrix With bias vector All are initialized using a random normal distribution, and the learning rate is set accordingly. Number of iterations Iteration change threshold 3. Initiate pairwise interactive training with the other three algorithms: Interact with the multi-kernel local preservation projection: receive the optimized low-dimensional features from its output. Used for similarity evaluation in relational attention weight calculation. Interacts with adaptive weighted isolated forest: receives the user node anomaly contribution from its output. This is used for calculating user node attention weights. It interacts with evidence chain-weighted Bayesian inference: it assigns initial attention weights... , Used for calculating the weight of evidence, receiving the confidence level of evidence output. 4. Forward propagation process: Constructing a heterogeneous graph based on the input data. The attention weight of each node is calculated according to the formula of the dual attention mechanism described above. Attention weights related to each edge Then, the updated feature vector of each user node is calculated using the node feature update formula. 5. Loss Function Definition: The cross-entropy loss function is used to calculate the classification loss between the predicted value and the true label. Evidence confidence loss and anomaly contribution loss are also introduced to ensure that model training not only focuses on classification accuracy but also considers collaborative optimization with other algorithms. The loss function is as follows: ;in Number of candidate users; For user nodes The probability of electricity theft is predicted. This is the output layer weight vector. For output layer bias; The confidence level of true evidence output by weighted Bayesian inference for the chain of evidence. The confidence level of the evidence for the model's predictions; The true anomaly contribution of the adaptive weighted isolated forest output. The contribution of anomalies to model predictions; , The loss weights are used to balance the proportion of classification loss and collaborative loss. 6. Backpropagation and parameter update: The gradient of the loss function with respect to all model parameters is calculated using gradient descent. The parameters are updated along the negative gradient direction, while the confidence level of true evidence is used. Compared with the actual abnormal contribution 7. Calculate the change in attention weights. and ,like and ,or If the interaction termination condition is met, training should stop; otherwise... Return to step 3 and continue iterating. 8. When the interaction termination condition is met, complete the training of the graph neural collaborative reasoning model guided by the dual attention mechanism.

[0075] Model application process: 1. Input the user basic profile of S1 Text feature set The low-dimensional eigenvectors of S2 Abnormal contribution S3 candidate user list Historical case similarity Construct a heterogeneous graph of candidate users based on the rule matching results. This ensures that the graph structure can comprehensively cover the relationships between multi-source heterogeneous data. 2. Based on the constructed heterogeneous graph... According to the calculation formula of the dual attention mechanism, the attention weights of all nodes are calculated sequentially. Relationship attention weights with all edges 3. Accurately characterize the importance of each node and edge. Substitute the node feature update formula to update the feature vector of each candidate user node. This vector integrates user-specific features, related feature node information, and knowledge base node information, comprehensively reflecting the user's suspected electricity theft characteristics. 4. Node attention weights Feedback is fed into a multi-core local preservation projection and evidence chain weighted Bayesian inference algorithm to incorporate relational attention weights. Feedback is fed into the adaptive weighted isolation forest and evidence chain weighted Bayesian inference algorithms to optimize their key parameters. 5. Output the weighted feature vector for each candidate user. and dual attention weight matrix These outputs are then passed to the evidence chain weighted Bayesian inference model, providing a foundation for evidence chain weighted inference.

[0076] Core Role and Contribution: Graph Neural Collaborative Reasoning Guided by Dual Attention Mechanism, as the core algorithm for multi-source data fusion, overcomes the limitations of traditional fusion algorithms in handling heterogeneous data associations and lacking dynamic weight adjustment mechanisms. By constructing a three-layer heterogeneous graph of user-feature-knowledge, it breaks down the barriers between structured features, text features, and knowledge base knowledge, achieving deep association of multi-source information. Through the fusion of dual attention mechanism and multi-directional feedback signals, it dynamically adjusts the importance weights of nodes and edges, enabling the fusion process to focus on key information with high importance, high confidence, and high anomaly. Simultaneously, the output attention weights provide accurate feature importance signals for the other three algorithms, promoting the formation of a collaborative optimization closed loop throughout the entire algorithm process, effectively solving the core problems of insufficient multi-source heterogeneous data fusion and unreasonable weight allocation.

[0077] The evidence chain weighted Bayesian inference algorithm, based on Bayes' theorem, uses the attention weights output by the graph neural collaborative inference guided by the dual attention mechanism as the weights of the evidence chain. The system integrates multi-source evidence to calculate the posterior probability of electricity theft for candidate users, achieving accurate determination of the electricity theft risk level. This model not only interacts directly with the graph neural collaborative inference guided by the dual attention mechanism, but also receives dual-path feedback from low-dimensional features that preserve local projections through multi-kernel systems and anomaly scores from adaptive weighted isolated forests, dynamically adjusting the likelihood probability parameters. Simultaneously, it outputs evidence confidence and the posterior probability of electricity theft as feedback to the other three algorithms, achieving deep collaborative optimization of the four algorithms.

[0078] 1. Definition of the chain of evidence: To comprehensively cover all evidence related to the determination of electricity theft, a chain of evidence consisting of four core types of evidence is constructed. The details are as follows: Evidence of outlier scores, i.e., candidate users output by the adaptive weighted isolated forest. Abnormal scores This directly reflects the degree of abnormality in a user's electricity consumption behavior. Feature matching evidence, based on low-dimensional feature vectors from multi-kernel local preserving projection output. Feature vectors of historical electricity theft cases cosine similarity The calculation method is as follows This means taking the maximum similarity between the user and all historical cases, reflecting the degree to which the user's electricity consumption pattern matches known electricity theft patterns. Textual semantic evidence, based on the text feature vector output by S1. The semantic vectors of the text are extracted using the large language model BERT. The mean cosine similarity between the vector and the electricity theft keyword vector library (which contains 100 electricity theft-related keyword vectors such as unauthorized wiring, modified electricity meters, and slow electricity meters) is calculated. The higher the score, the more obvious the clues to electricity theft in the text. Rule-matching evidence, based on the rule-matching results of S3, is calculated as follows: This is the ratio of the number of anti-electricity theft rules satisfied to the total number of rules, reflecting the degree to which user behavior matches known electricity theft rules.

[0079] 2. Weight of Evidence: The weight of each piece of evidence in the chain of evidence. weight Node attention weights in graph neural collaborative reasoning output guided by dual attention mechanism Relational attention weights A joint decision, in which As evidence Corresponding feature nodes, The formula for the associated edges between feature nodes and user nodes is as follows:

[0080] The formula uses normalization to make the sum of the weights of the four types of evidence equal to 1, ensuring that the weights accurately reflect the relative importance of each piece of evidence in determining electricity theft. The higher the node attention weight and relation attention weight, the greater the corresponding evidence weight, and the greater its proportion in the reasoning process.

[0081] 3. Prior probability and likelihood probability: Prior probability Based on statistical data from the power grid company's anti-electricity theft history over the past three years, let's assume... , representing the probability that a randomly selected low-voltage residential user is a electricity thief without any evidence. Likelihood probability. This indicates that the user has indeed engaged in electricity theft. Under the condition of ), evidence The probability of occurrence was obtained using frequency statistics based on 10,000 historical cases, as shown in the example below: (85% of users who steal electricity have an abnormal score ≥0.6). (Among users who steal electricity, 12% had anomaly scores between 0.5 and 0.6). (The proportion of users with an abnormal score <0.5 among those who steal electricity is 3%) (78% of users who steal electricity have a feature matching score ≥0.7). (Among users who steal electricity, 15% have a feature matching score between 0.6 and 0.7). (7% of users who steal electricity have a feature matching score of <0.6). (65% of users who stole electricity had a textual semantic evidence score ≥0.5). (20% of users who steal electricity have a textual semantic evidence score between 0.4 and 0.5). (The proportion of users who steal electricity with a textual semantic evidence score <0.4 is 15%) (82% of users who steal electricity have a rule matching score of ≥0.5). (Among users who steal electricity, 13% have a rule matching score between 0.3 and 0.5). (The proportion of users who steal electricity with a rule matching score of <0.3 is 5%)

[0082] Likelihood probability : Indicates that the user's electricity consumption behavior is normal ( Under the condition of ), evidence The probability of occurrence was also obtained through frequency statistics based on 50,000 historical normal electricity consumption cases, as shown in the following example: (The proportion of normal users with an abnormal score ≥0.6 is 5%) (Among normal users, the proportion of those with abnormal scores between 0.5 and 0.6 is 8%) (Among normal users, the proportion of those with abnormal scores <0.5 is 87%). (The proportion of normal users with a feature matching score ≥0.7 is 3%) (The proportion of normal users with feature matching scores between 0.6 and 0.7 is 6%) (Among normal users, the proportion with a feature matching score <0.6 is 91%) (The proportion of normal users with a text semantic evidence score ≥0.5 is 4%) (The proportion of normal users with a text semantic evidence score between 0.4 and 0.5 is 9%) (87% of normal users have a text semantic evidence score <0.4). (The proportion of normal users with a rule matching score ≥0.5 is 2%) (Among normal users, the proportion with a rule matching score between 0.3 and 0.5 is 7%) (Among normal users, 91% had a rule matching score <0.3)

[0083] 4. Posterior probability formula: Based on the weighted Bayes theorem, the weights and likelihood probabilities of the four types of evidence are combined to calculate the candidate user probability. The posterior probability of electricity theft, that is, the probability that a user is a electricity thief given all the evidence, is given by the following formula:

[0084] ;

[0085] in The formula represents the prior probability of normal electricity use. It integrates the likelihood probabilities of each piece of evidence through a weighted product. The higher the weight of the evidence, the greater its likelihood probability has an impact on the posterior probability, thus accurately reflecting the importance of each piece of evidence in determining electricity theft.

[0086] 5. Calculation of the confidence level of evidence: Confidence level of evidence Used to measure evidence The reliability and contribution of the determination of electricity theft are jointly determined by the likelihood ratio of the evidence and the similarity of low-dimensional features, as shown in the following formula:

[0087] ;in In order to connect with users The feature vector of the historical electricity theft case with the highest feature matching degree. This represents the maximum similarity. The core idea of ​​this formula is to consider both the ability of evidence to distinguish between electricity theft and normal conditions, and the similarity between the user and historical electricity theft cases, making the confidence level more targeted. The confidence level range is... When the likelihood ratio is ≥100 and the similarity is ≥0.8, the confidence level is set to the maximum value of 5; when the likelihood ratio is ≤1 or the similarity is <0.4, the confidence level is set to the minimum value of 0.

[0088] Model training process: 1. Input training data: Evidence chains of historical candidate users Node attention weights in graph neural collaborative reasoning output guided by dual attention mechanism Relational attention weights Low-dimensional features of multi-kernel locally preserved projection output Anomaly scores in adaptive weighted isolated forest output and historical verification result tags 1. Ensure that the training data covers different types of electricity theft scenarios and evidence combinations. 2. Initialize the likelihood probability parameters (using the initial values ​​obtained from the above statistics) and set the learning rate. Number of iterations Iteration change threshold 3. Initiate pairwise interactive training with the other three algorithms: Interact with the multi-kernel local preservation projection: receive the optimized low-dimensional features from its output. It is used for feature matching evidence calculation and evidence confidence calculation. It interacts with adaptive weighted isolated forest: receiving its optimized anomaly scores. This serves as evidence of abnormal scores and is updated accordingly. Interaction with graph neural collaborative reasoning guided by a dual-attention mechanism: receiving optimized attention weights from its output. , 4. Calculate the weight of evidence. Substitute the values ​​into the posterior probability formula to calculate the predicted posterior probability of electricity theft for each historical candidate user. 5. Loss Function and Parameter Optimization: The mean squared error loss function is used to calculate the loss between the predicted posterior probability and the historical verification result labels. ;in Given the number of historical training samples, update the likelihood probability parameters using gradient descent, adjusting the likelihood probability values ​​for each interval to minimize the loss function. 6. Calculate the change in likelihood probability. ,like ,or If the interaction termination condition is met, training should stop; otherwise... Return to step 3 and continue iterating. 7. When the interaction termination condition is met, calculate the confidence level of the true evidence corresponding to each piece of evidence. Post-hoc probability of electricity theft The results are fed back to three algorithms: multi-core local preservation projection, adaptive weighted isolated forest, and graph neural collaborative reasoning guided by dual attention mechanism, to optimize their key parameters and complete the training of the evidence chain weighted Bayesian reasoning model.

[0089] Model application process: 1. Input the node attention weights of the graph neural collaborative inference guided by the dual attention mechanism. Relationship attention weight Low-dimensional features of multi-kernel locally preserved projection output Anomaly scores in adaptive weighted isolated forest output The similarity between the rule matching results of S3 and historical cases and S1 text feature vector The semantic vectors processed by the BERT model are used to construct a complete chain of evidence for each candidate user. 2. Calculate the weights of the four types of evidence according to the weighting formula. 3. Substitute the values ​​into the posterior probability formula, and combine the optimized prior probability and likelihood probability parameters to calculate the posterior probability of electricity theft for each candidate user. The risk level is determined according to the following rules: High-risk response This indicates a very high probability of electricity theft by users, requiring priority investigation; medium-risk response. This indicates a high suspicion of electricity theft by the user, requiring scheduled inspections; low-risk response. This indicates a low probability of electricity theft by the user; therefore, no immediate investigation will be arranged, but the case will be included in subsequent follow-up observation. 4. Calculate the confidence level for each piece of evidence using the evidence confidence formula. Compare it with the posterior probability of electricity theft Three algorithms—multi-core local preservation projection, adaptive weighted isolated forest, and graph neural collaborative reasoning guided by a dual-attention mechanism—are fed back together to optimize their key parameters such as attention weights, kernel function weights, and sample weights, achieving interactive optimization among the four algorithms. 5. Combining the dual-attention weights output by the graph neural collaborative reasoning guided by the dual-attention mechanism with the evidence chain analysis results, a natural language assessment report is generated. The report includes the risk level, key abnormal evidence (sorted by confidence level, listing specific evidence types, values, and weights), suspected electricity theft methods (inferred from the electricity theft methods with the highest similarity to historical cases), recommended verification measures (developed specifically for suspected electricity theft methods, specifying verification equipment, verification locations, and verification procedures), and explanations of historical case similarity (explaining which historical electricity theft case is most similar, the similarities, and the similarity values), ensuring the report is highly interpretable and practical.

[0090] Core Role and Contribution: As the core algorithm for the entire process of judgment, the evidence chain weighted Bayesian inference breaks through the limitations of traditional Bayesian inference, such as fixed evidence weights, reliance on a single data source, and lack of multi-directional collaborative optimization. By integrating four types of core evidence, it comprehensively covers multiple dimensions of evidence for electricity theft, including abnormal behavior, feature matching, textual clues, and rule fit, avoiding the one-sidedness of single-evidence judgment. By introducing attention weights in graph neural collaborative inference guided by a dual-attention mechanism, the evidence weights can dynamically adapt to the correlation strength of multi-source data, improving the accuracy of inference. By receiving low-dimensional features with multi-kernel local preservation projection and anomaly scores from adaptive weighted isolated forests, it achieves dynamic optimization of likelihood probability parameters, enabling the model to quickly adapt to new electricity theft patterns. At the same time, the output evidence confidence and posterior probability of electricity theft provide key judgment signal feedback for the other three algorithms, promoting the formation of a collaborative optimization closed loop in the entire process algorithm, effectively solving the core problems of poor interpretability and insufficient robustness of traditional judgment methods.

[0091] S5: On-site verification and standardized result feedback by inspectors; Based on the judgment report output by S4, a standardized inspection workflow is constructed, inspectors are dispatched to carry out on-site verification, the verification results and new evidence are collected in a comprehensive manner, data recording and feedback are completed according to a unified template, and a standardized feedback dataset is formed. This provides real and reliable actual business data support for subsequent model and knowledge base updates, ensuring the closed-loop nature of the entire judgment process.

[0092] 1. Inspection Work Order Generation and Scheduling: Based on the risk level output by S4, the system automatically generates inspection work orders according to the principle of prioritizing high-risk, followed by medium-risk, and temporarily suspending low-risk cases. The work order content is comprehensive and standardized, including the core information of the candidate user (user identifier, detailed address, contact information), risk level, suspected electricity theft methods, suggested verification measures (such as carrying meter testing equipment to check whether the metering chip has been modified, retrieving the area's surveillance footage to view suspicious personnel activities at night, and using a line tester to check for unauthorized wiring), and access permissions for the structured evidence chain (inspectors can view the complete evidence chain through the work order link, including the value, weight, confidence level, and similarity to historical cases of each piece of evidence), ensuring that inspectors can fully understand the user situation and the key points of verification before on-site verification. The system automatically assigns work orders to the corresponding inspectors based on the transformer substation affiliation, the inspectors' current workload, and the inspectors' professional skills (e.g., those skilled in handling illegal wiring theft are given priority for work orders, and those skilled in meter modification are given priority for work orders). The system then pushes the work orders to the inspectors' mobile terminals through the power grid company's internal work order scheduling system and sends reminder notifications (SMS + APP push) to ensure timely delivery of work orders.

[0093] 2. On-site Verification Execution: Inspectors, equipped with mobile terminals (supporting offline data entry, photo upload, location tracking, and encrypted data transmission) and corresponding equipment (meter testing equipment, line tester, infrared thermometer, photography equipment, recording equipment, etc.) for the recommended verification measures, will proceed to the user's site to conduct verification work. The verification process will be strictly carried out in accordance with the recommended verification measures, focusing on key areas corresponding to suspected electricity theft methods: If the metering chip is suspected of being modified, the meter casing will be opened to check the chip model and whether its appearance is normal, and the chip's operating parameters will be read using the meter testing equipment and compared with standard parameters; if unauthorized wiring is suspected, indoor and outdoor wiring will be traced along the user's incoming line to check for wiring that bypasses the meter, concealed wiring joints, etc.; if the meter seal is suspected of being removed, the meter seal will be checked for integrity and signs of tampering, and the seal number will be recorded and compared with the system registration number. During the verification process, inspectors meticulously recorded the process and results, including key information such as whether the meter's appearance was intact, whether the seal was complete, whether the metering chip was functioning properly, whether the wiring was compliant, and whether the real-time electricity consumption parameters were consistent with the system records. They also took photos of the site (2-3 photos of each key part to ensure clarity), including the overall condition of the meter, details of key components, wiring conditions, and close-ups of the seal. After authorization, they read the meter's internal operating parameters and collected meter detection data (real-time data such as current, voltage, power, and metering error), which were then compared and analyzed on-site with the measurement data from S1 and the judgment results from S4.

[0094] 3. Verification Result Judgment and Recording: Based on all evidence collected during the on-site verification (observation records, on-site photos, meter test data, audio recordings), the inspectors comprehensively judge the verification results. Verification results are divided into three categories, as shown in the examples below: Confirmed Electricity Theft: On-site evidence clearly proves that the user has engaged in electricity theft, such as the meter chip being replaced, test data showing a measurement error exceeding 30%, the discovery of unauthorized wiring bypassing the meter, a difference of 5A between the line current and the meter's recorded current, the meter seal being pried open, or internal wiring being altered. False Alarm: On-site evidence indicates that the user has not engaged in electricity theft, and the anomaly is caused by other reasonable reasons, such as a temporary meter malfunction leading to inaccurate measurement, test data showing excessive meter error (repair personnel have been contacted), the anomaly being due to seasonal changes in user electricity consumption (e.g., reduced air conditioning use in summer resulting in a 30% decrease in electricity consumption, within the normal fluctuation range), or abnormal line loss in the transformer area causing abnormal user electricity data (line faults have been investigated and repaired), etc. Supplementary verification is required if there is insufficient evidence: If on-site evidence is insufficient to definitively determine whether electricity theft has occurred, such as slightly abnormal meter operating parameters but no signs of tampering, the meter manufacturer's technicians need to be contacted for further testing; if a wiring connection is found but it cannot be confirmed whether it was used for electricity theft, nearby surveillance footage needs to be retrieved for further verification. For users confirmed to have stolen electricity, inspectors will record the specific handling results, including the amount of electricity fees to be recovered (calculated based on the actual amount of electricity stolen × the corresponding electricity price), the amount of the fine (calculated at 1-3 times the recovered electricity fees, depending on the severity of the theft), whether to terminate power supply (immediate termination or termination after a period of rectification), and whether to transfer the case to judicial authorities (for cases involving large amounts of stolen electricity or serious circumstances, the case will be transferred to the public security authorities). For users who falsely reported the theft, the reasons for the false report will be explained in detail, clarifying the specific causes of the abnormality. For users with insufficient evidence, a supplementary verification plan will be developed, specifying the evidence that needs to be collected (such as manufacturer's test reports, surveillance videos, third-party appraisal feedback, etc.) and the time for re-verification (in principle, no more than 7 working days).

[0095] 4. Standardized Feedback: Inspectors use mobile terminals to enter all relevant verification data according to the system's preset standardized templates. Template fields are as follows: User ID, Work Order Number, Verification Date, Inspector, Verification Result (Confirmed Electricity Theft / False Alarm / Insufficient Evidence), Electricity Theft Method (If electricity theft is confirmed, select the corresponding type: Modifying the meter chip / Unauthorized wiring / Removing the meter seal / Altering the meter wiring / Other), Processing Result (Amount of electricity fees recovered, Amount of fines, Whether power supply was terminated, Whether the case was transferred to judicial authorities), Reason for False Alarm (If false alarm, select the corresponding type: Meter malfunction / Seasonal electricity consumption changes / Line malfunction / Data statistical error / Other, detailed explanation required), Supplementary Verification Plan (If evidence is insufficient, fill in the type of supplementary evidence, acquisition method, and re-verification time), On-site Photos (Upload by category: Meter photo, Line photo, Seal photo, Testing equipment reading photo, etc.), Meter Testing Data (Current, Voltage, Power, Metering Error, etc.), Audio Recordings (Key Communication Content). During the data entry process, the system provides data validation functions: the amount field must be a numeric type, and the amount of electricity bill to be recovered must be ≥0; the photo must be clear and identifiable (blurry photos cannot be submitted); required fields cannot be submitted if they are not filled in. After data entry is completed, the inspector submits feedback data. The system automatically associates the user identifier, work order number, and feedback data, encrypts the data, and uploads it to the system database to form a standardized feedback dataset. ,in Including the All verification-related data for each candidate user.

[0096] 5. Output: Output standardized feedback dataset This dataset will be passed to S6 as the core input for end-to-end updates of the model and knowledge base, ensuring that real business data can effectively feed back into the model and knowledge base and improve the continuous optimization capability of the entire discrimination system.

[0097] S6: Result feedback and end-to-end model update; using the standardized feedback dataset output from S5. Based on the core update criteria, the system achieves full-link iterative updates of the electricity theft knowledge base, the two anomaly detection algorithms of S2 (multi-core local preservation projection + adaptive weighted isolated forest), and the two comprehensive judgment algorithms of S4 (graph neural collaborative reasoning guided by dual attention mechanism + evidence chain weighted Bayesian reasoning). This enables the system to continuously absorb new information, new cases, and new patterns from actual business, constantly improve the accuracy and adaptability of electricity theft behavior judgment, and ensure that the system maintains high-efficiency judgment performance in dynamically changing electricity theft scenarios.

[0098] 1. Electricity Theft Knowledge Base Update: Confirmed updates to electricity theft user data: based on standardized feedback datasets. For users whose verification results confirm electricity theft, their complete data will be added to the electricity theft knowledge base. An example of the added content is as follows: the low-dimensional feature vector of S2. Abnormal scores Abnormal contribution Historical case similarity of S3 Rule matching results (specific rules satisfied); S4's chain of evidence Risk level, posterior probability Confidence of evidence The new evidence for S5 (on-site photos, meter readings, audio recordings), processing results, and confirmation results of electricity theft methods (clearly defining the specific type of electricity theft) are organized according to the historical case format, assigned a unique case number, and added to the historical electricity theft case database as new cases. Simultaneously, the electricity theft patterns and characteristics of the new cases are analyzed. If new electricity theft methods are discovered (such as tampering with metering data using smart meter remote communication vulnerabilities, interfering with meter counting via Bluetooth modules, etc., new electricity theft methods not included in the existing rule base), corresponding discrimination rules are added (in the format of rule number-triggering condition-suspected electricity theft type) and supplemented to the anti-electricity theft rule base. If vulnerabilities are found in existing rules (such as an increased false positive rate for a certain rule), the triggering conditions of the rules are adjusted (such as adjusting the abnormal score threshold, adding feature matching conditions) to optimize the rule base. False alarm user data updates: For users whose verification results are false alarms, their data is marked as non-electricity theft abnormal cases and added to the non-electricity theft abnormal case database of the knowledge base. An example of the supplementary content is as follows: S2 abnormal score. low-dimensional feature vectors Abnormal contribution The chain of evidence for S4 The data includes risk level, posterior probability; false alarm causes, on-site verification evidence, and anomaly analysis for S5. By labeling this data, a reference basis is provided for subsequent models to distinguish between electricity theft anomalies and normal anomalies. Simultaneously, the common characteristics and causes of false alarm cases are analyzed. If a rule in the anti-electricity theft rule base is found to be the main cause of false alarms (e.g., the false alarm rate exceeds 20% in cases triggered by a certain rule), then that rule is optimized and adjusted (e.g., increasing the anomaly score threshold for rule triggering, adding textual semantic evidence constraints) to reduce the subsequent false alarm rate.

[0099] 2. Anomaly Detection Model Update: Training Set Expansion: From Standardized Feedback Dataset Extract data from all confirmed electricity theft users and label them as positive examples; extract data from all false alarm users and label them as negative examples; add these samples to the original training set of the S2 model to form a new expanded training set. The training set is expanded to retain all samples from the original training set, while new samples are appended in chronological order to ensure the temporal continuity and representativeness of the data. Multi-kernel locally preserving projection model update: based on the expanded training set. The model training process is re-executed, including: receiving the latest feedback signals (anomaly contribution, attention weight, and evidence confidence) from three algorithms: adaptive weighted isolated forest, graph neural collaborative reasoning guided by dual attention mechanism, and evidence chain weighted Bayesian reasoning; and recalculating the kernel function weighting coefficients. Reconstruct the adjacency matrix and Laplace matrix, solve the generalized eigenvalue problem, and update the projection matrix. Simultaneously, based on the characteristics of false positive cases, the regularization parameter in the objective function is adjusted. This makes the dimensionality reduction process better able to distinguish between abnormal electricity theft features and normal abnormal features, improving the recognition accuracy of low-dimensional features. Adaptive weighted isolated forest model update: The training set will be expanded. Input the updated multi-kernel local preserving projection model to generate new low-dimensional feature vectors. ;based on With corresponding labels (positive / negative examples), retrain the model: receiving relational attention weights from graph neural collaborative inference guided by a dual attention mechanism and posterior probabilities from evidence chain-weighted Bayesian inference, update sample weights and isolation tree precision weights; reconstruct 100 isolation trees, adjust the splitting strategy of the isolation trees (reduce splitting priority for feature dimensions with high false positive rates); recalibrate the isolation tree precision. The calculation logic for anomaly score and anomaly contribution is optimized to reduce sensitivity to normal anomaly features and improve the accuracy of anomaly detection.

[0100] 3. Comprehensive evaluation of model updates: Training data update: Standardize the feedback dataset. The verification results (confirmed electricity theft / false alarm) are used as new labels. Combined with multi-source data from S1 to S3 (updated user profiles, text features, low-dimensional features, and rule matching results), new training data for both models is formed. The new training data contains the latest user features, knowledge base association information, and real verification results, providing reliable supervision information for model updates. The graph neural collaborative reasoning model update guided by the dual attention mechanism: Based on the new training data, the model training process is re-executed: receiving the latest low-dimensional features of multi-kernel local preservation projection, the latest anomaly contribution of adaptive weighted isolated forest, and the latest evidence confidence of evidence chain weighted Bayesian inference, reconstructing the user-feature-knowledge heterogeneous graph; and updating the node attention parameters. Relational attention parameters Graph convolution parameters The calculation logic for dual attention weights was adjusted. The attention weights of invalid feature nodes with excessively high weights in false alarm cases were reduced, while the weights of nodes corresponding to key evidence in confirmed electricity theft cases were increased, thereby improving the accuracy of feature fusion. The evidence chain weighted Bayesian inference model was updated: based on new training data, the likelihood probability parameters were recalculated. and The system incorporates the evidence distribution characteristics of newly confirmed electricity theft cases and false alarm cases to ensure that the likelihood probability reflects the latest evidence patterns; it updates the calculation logic of evidence weight and evidence confidence, adjusts the weight coefficient and confidence influence factor; and it retrains the model to optimize the accuracy of posterior probability calculation, making risk level judgment more in line with actual business scenarios and reducing the false judgment rate.

[0101] 4. Update Cycle and Verification: A full-link update will be automatically executed once a month (fixed on the last working day of each month to avoid impacting business operations). If more than 500 new confirmed electricity theft cases are added in a month, or the false alarm rate exceeds 8%, an emergency update will be initiated (completed within 72 hours). After each update, a reserved test set (nearly 6 months of historical business data not used in model training, including 1000 normal cases, 200 electricity theft cases, and 150 false alarm cases) will be used to verify the performance of all updated models. Examples of evaluation metrics are as follows: Anomaly Detection Accuracy: The proportion of correctly identified normal users and electricity theft users, target ≥90%; Anomaly Detection Recall Rate: The proportion of correctly identified actual electricity theft users, target ≥85%; False Alarm Rate: The proportion of normal users incorrectly identified as anomalies, target ≤5%; Risk Level Judgment Accuracy: The proportion of high / medium / low risk judgment results consistent with actual verification results, target ≥88%; Evidence Chain Matching Accuracy: The proportion of key evidence in the analysis report consistent with on-site verification evidence, target ≥92%. If the verification result does not meet the preset standard, the update process is backtracked, the model parameters (such as learning rate and regularization parameters) or training data (abnormal samples are removed), and the update process is re-executed until the verification is successful.

[0102] 5. Output Results: The system will output an updated electricity theft knowledge base (including newly added historical cases, an optimized rule base, and a non-electricity theft anomaly case base), an updated anomaly detection model (multi-core local preservation projection + adaptive weighted isolation forest), and an updated comprehensive judgment model (graph neural collaborative reasoning guided by dual attention mechanism + evidence chain weighted Bayesian reasoning). These updated results will be used in the next round of intelligent electricity theft behavior identification process to achieve continuous optimization and iterative upgrades of the system, ensuring that the system can accurately adapt to the ever-changing electricity theft scenarios and business needs.

[0103] This application also provides an intelligent system for identifying electricity theft behavior of low-voltage residential users based on a large language model, such as... Figure 5 As shown, it includes the following modules:

[0104] The data acquisition and processing module is used to collect structured data from low-voltage residential users, including electricity consumption data, transformer operation data, and basic user information, as well as unstructured text data, including anti-electricity theft historical case files, inspection records, customer service work orders, complaint and report texts, and feedback information. The data is then cleaned, desensitized, standardized, and tagged to form an analysis dataset, a text feature set, and a basic user profile.

[0105] The low-dimensional feature vector generation module is used to perform feature dimensionality reduction on the structured data in the analysis dataset using multi-kernel local preservation projection to generate low-dimensional feature vectors.

[0106] The suspected abnormal user list composition module is used to input low-dimensional feature vectors into the adaptive weighted isolation forest, calculate the abnormal score and abnormal contribution of each user, and filter users whose abnormal scores reach a set threshold to form a suspected abnormal user list.

[0107] The candidate user list formation module is used to call a pre-built electricity theft knowledge base, retrieve historical electricity theft cases that are similar to the low-dimensional feature vectors of suspected abnormal users, extract the features of related users, combine the anti-electricity theft rule base to perform rule matching on the related users in the transformer area where the suspected abnormal user is located, filter out the related users that meet the rules, and merge them with the suspected abnormal user list to form a candidate user list.

[0108] The attention weight calculation module is used to construct a three-layer heterogeneous graph of user-feature-knowledge. It adopts a dual attention graph neural collaborative reasoning algorithm, which integrates the low-dimensional feature vectors of candidate users, user basic profiles, text feature sets and electricity theft knowledge base information, and calculates node attention weights and relation attention weights.

[0109] The electricity theft detection result generation module is used to further employ the evidence chain weighted Bayesian inference algorithm, allocate evidence weights based on node attention weights and relation attention weights, integrate abnormal score evidence, feature matching evidence, text semantic evidence, and rule matching evidence, calculate the posterior probability of electricity theft for candidate users and the confidence level of evidence, determine the risk level, and generate a structured analysis report containing key abnormal evidence, suspected electricity theft methods, and suggested verification measures.

Claims

1. A method for intelligently identifying electricity theft behavior of low-voltage residential users based on a large language model, characterized in that, include: S1: Collect structured data from low-voltage residential users, including electricity consumption data, transformer operation data, and basic user information, as well as unstructured text data, including historical case files of anti-electricity theft, inspection records, customer service work orders, complaint and report texts, and feedback information. Then, clean, de-identify, standardize, and label the data to form an analysis dataset, a set of text features, and a basic user profile. S2: Multi-kernel local preservation projection is used to perform feature dimensionality reduction on the structured data in the analysis dataset to generate low-dimensional feature vectors; the low-dimensional feature vectors are input into an adaptive weighted isolation forest to calculate the anomaly score and anomaly contribution of each user, and users whose anomaly scores reach the set threshold are selected to form a list of suspected anomaly users. S3: Call the pre-built electricity theft knowledge base, retrieve historical electricity theft cases similar to the low-dimensional feature vectors of suspected abnormal users, extract the features of related users, combine the anti-electricity theft rule base to perform rule matching on the related users in the transformer area where the suspected abnormal user is located, filter the related users that meet the rules, and merge them with the list of suspected abnormal users to form a candidate user list. S4: Construct a three-layer heterogeneous graph of user-feature-knowledge, and adopt a dual-attention graph neural collaborative reasoning algorithm to integrate the low-dimensional feature vectors of candidate users, user basic profiles, text feature sets and electricity theft knowledge base information, and calculate node attention weights and relation attention weights; then adopt an evidence chain weighted Bayesian reasoning algorithm to allocate evidence weights based on node attention weights and relation attention weights, integrate abnormal score evidence, feature matching evidence, text semantic evidence, and rule matching evidence, calculate the posterior probability of electricity theft of candidate users and evidence confidence, determine the risk level and generate a structured analysis report containing key abnormal evidence, suspected electricity theft methods, and suggested verification measures; The process of multi-kernel local preservation projection is as follows: multiple heterogeneous kernel functions are fused, a neighborhood graph is constructed by calculating the kernel distance between structured data of different users, a Laplacian matrix is ​​generated based on the neighborhood graph, and an objective function is constructed by combining the anomaly contribution, the feedback node attention weight and the evidence confidence to minimize the local structure loss after high-dimensional data projection. The projection matrix is ​​obtained by solving the objective function, and the high-dimensional structured data is mapped into low-redundancy low-dimensional feature vectors through the projection matrix. The process of adaptive weighted isolation forest is as follows: calculate the initial sample weight based on the variance of low-dimensional feature vectors, integrate multiple isolation trees to randomly split the samples, record the path length of each user sample in each isolation tree, calculate the precision weight based on the detection precision of each isolation tree, and calculate the anomaly score by weighting the path length and precision weight. The abnormal contribution is obtained by fusing the abnormal score, low-dimensional feature variance, and feedback posterior probability of electricity theft, and then normalizing the result.

2. The intelligent method for identifying electricity theft by low-voltage residential users based on a large language model as described in claim 1, characterized in that, Also includes: S5: Push the structured analysis report to the inspectors to conduct on-site verification, record the verification results, new evidence and processing results, and form a standardized feedback dataset; S6: The standardized feedback dataset is fed back to the electricity theft knowledge base for updating. At the same time, the feedback data is used as new samples to iteratively optimize the model parameters of multi-core local preservation projection, adaptive weighted isolated forest, dual attention map neural collaborative reasoning, and evidence chain weighted Bayesian reasoning, so as to achieve continuous iteration of knowledge and model.

3. The intelligent method for identifying electricity theft by low-voltage residential users based on a large language model as described in claim 1, characterized in that, The labeling process for unstructured text data in S1 specifically includes: performing semantic parsing on unstructured text data using a large language model, extracting keywords, event elements, and semantic tendencies related to electricity theft, mapping the text data into a fixed-dimensional vector representation, and generating a set of text features by combining text source type tags; among which, event elements include descriptions of electricity theft methods, mentions of evidence types, statements related to processing results, and core content of user demands.

4. The intelligent method for identifying electricity theft by low-voltage residential users based on a large language model according to claim 1, characterized in that, The process of dual-attention graph neural collaborative reasoning is as follows: the user node feature vector is composed of low-dimensional feature vector, user basic profile feature vector, text feature vector and anomaly contribution vector; the feature vectors of feature nodes and knowledge base nodes are composed of the semantic representation and association strength features of the corresponding data; the node attention weight is calculated by fusing node feature vector, evidence confidence and anomaly contribution, and the relation attention weight is calculated by fusing edge type encoding and the similarity of the corresponding node's low-dimensional features; the feature vectors of neighboring nodes and dual attention weights are fused through graph convolution operation to update the user node feature vector to strengthen the representation of key information.

5. The intelligent method for identifying electricity theft by low-voltage residential users based on a large language model according to claim 1, characterized in that, The weighted Bayesian inference process is as follows: Anomaly score evidence directly uses the anomaly score output by an adaptive weighted isolated forest; feature matching evidence calculates the similarity between the candidate user's low-dimensional feature vector and the low-dimensional feature vector of historical electricity theft cases, taking the maximum value as the feature matching evidence value; textual semantic evidence is obtained by calculating the average similarity between the text feature vector and the electricity theft keyword vector library using a large language model; rule matching evidence is obtained by statistically analyzing the proportion of candidate users who satisfy predefined rules in the anti-electricity theft rule library; weights are assigned to each piece of evidence based on the product of node attention weights and relational attention weights, and the weighted Bayesian formula is used to calculate the posterior probability of electricity theft. The evidence confidence is then obtained by combining the likelihood ratio and the maximum similarity of feature matching.

6. The intelligent method for identifying electricity theft by low-voltage residential users based on a large language model according to claim 1, characterized in that, S2 and S4 have bidirectional interaction logic: the multi-kernel local preservation projection receives the node attention weights from the dual-attention graph neural collaborative inference output and the evidence confidence from the evidence chain weighted Bayesian inference output, dynamically adjusting the kernel function weighting coefficients and projection matrix; the dual-attention graph neural collaborative inference receives the low-dimensional feature vectors from the multi-kernel local preservation projection output and the anomaly contribution from the adaptive weighted isolated forest output, optimizing the calculation of node and relation attention weights; the evidence chain weighted Bayesian inference receives the low-dimensional feature vectors from the multi-kernel local preservation projection output and the anomaly scores from the adaptive weighted isolated forest output, adjusting the evidence weight allocation and likelihood probability parameters; each interaction terminates when the parameter change is below a set threshold or when a set number of iterations is reached.

7. The intelligent method for identifying electricity theft by low-voltage residential users based on a large language model according to claim 1, characterized in that, There is an interaction logic between multi-kernel local preservation projection and adaptive weighted isolation forest: multi-kernel local preservation projection inputs the generated low-dimensional feature vectors into adaptive weighted isolation forest, providing a basis for calculating anomaly scores and anomaly contributions; adaptive weighted isolation forest feeds back the output anomaly contribution to multi-kernel local preservation projection, which is used to adjust the kernel function weighting coefficients and the optimization direction of the objective function, thereby improving the ability of low-dimensional feature vectors to represent anomaly patterns; the interaction ends when the change in the kernel function weighting coefficients is lower than a set threshold or the number of iterations reaches a set value.

8. The intelligent method for identifying electricity theft by low-voltage residential users based on a large language model according to claim 1, characterized in that, There is an interactive logic between dual-attention graph neural collaborative reasoning and evidence chain weighted Bayesian reasoning: dual-attention graph neural collaborative reasoning inputs the calculated node attention weights and relation attention weights into evidence chain weighted Bayesian reasoning as the core basis for evidence weight allocation; The evidence chain weighted Bayesian inference feeds back the output evidence confidence to the dual attention graph neural collaborative inference, which is used to adjust the calculation weight of the attention weight of nodes and relationships. Through interaction, the representation and utilization of key evidence are strengthened, and the accuracy of the posterior probability calculation of electricity theft is improved. The interaction ends when the change in attention weight is lower than a set threshold or when a set number of iterations is reached.

9. An intelligent system for identifying electricity theft by low-voltage residential users based on a large language model, characterized in that: It includes the following modules: The data acquisition and processing module is used to collect structured data from low-voltage residential users, including electricity consumption data, transformer operation data, and basic user information, as well as unstructured text data, including anti-electricity theft historical case files, inspection records, customer service work orders, complaint and report texts, and feedback information. The data is then cleaned, desensitized, standardized, and tagged to form an analysis dataset, a text feature set, and a basic user profile. The low-dimensional feature vector generation module is used to perform feature dimensionality reduction on the structured data in the analysis dataset using multi-kernel local preservation projection to generate low-dimensional feature vectors. The process of multi-kernel local preservation projection is as follows: multiple heterogeneous kernel functions are fused, a neighborhood graph is constructed by calculating the kernel distance between structured data of different users, a Laplacian matrix is ​​generated based on the neighborhood graph, and an objective function is constructed by combining the anomaly contribution, the feedback node attention weight and the evidence confidence to minimize the local structure loss after the high-dimensional data is projected. The projection matrix is ​​obtained by solving the objective function, and the high-dimensional structured data is mapped into low-redundancy low-dimensional feature vectors through the projection matrix. The suspected abnormal user list module is used to input low-dimensional feature vectors into an adaptive weighted isolation forest, calculate the abnormal score and abnormal contribution of each user, and filter users whose abnormal scores reach a set threshold to form a suspected abnormal user list. The adaptive weighted isolation forest process is as follows: calculate the initial sample weights based on the variance of the low-dimensional feature vectors, integrate multiple isolation trees to randomly split the samples, record the path length of each user sample in each isolation tree, calculate the precision weight based on the detection precision of each isolation tree, and calculate the abnormal score by weighting the path length and precision weight. The abnormal contribution is obtained by fusing the abnormal score, low-dimensional feature variance and feedback posterior probability of electricity theft, and then normalizing the result. The candidate user list formation module is used to call a pre-built electricity theft knowledge base, retrieve historical electricity theft cases that are similar to the low-dimensional feature vectors of suspected abnormal users, extract the features of related users, combine the anti-electricity theft rule base to perform rule matching on the related users in the transformer area where the suspected abnormal user is located, filter out the related users that meet the rules, and merge them with the suspected abnormal user list to form a candidate user list. The attention weight calculation module is used to construct a three-layer heterogeneous graph of user-feature-knowledge. It adopts a dual attention graph neural collaborative reasoning algorithm, which integrates the low-dimensional feature vectors of candidate users, user basic profiles, text feature sets and electricity theft knowledge base information, and calculates node attention weights and relation attention weights. The electricity theft detection result generation module is used to further employ the evidence chain weighted Bayesian inference algorithm, allocate evidence weights based on node attention weights and relation attention weights, integrate abnormal score evidence, feature matching evidence, text semantic evidence, and rule matching evidence, calculate the posterior probability of electricity theft for candidate users and the confidence level of evidence, determine the risk level, and generate a structured analysis report containing key abnormal evidence, suspected electricity theft methods, and suggested verification measures.

Images