Abnormal power consumption detection method and device based on hybrid model and medium

Abstract

The invention relates to an abnormal power consumption detection method and device based on a hybrid model and a medium. The method comprises the following steps: acquiring a real-time multi-dimensional feature vector; determining a target mixing model according to the real-time multi-dimensional feature vector, and outputting a target abnormal score through the target mixing model; wherein the target hybrid model comprises a first hybrid model and / or a second hybrid model, and the first hybrid model comprises a first AE branch and a Tiny CNN branch; the second hybrid model comprises a second AE branch and a TCN branch; and determining a target abnormal score through the target hybrid model. And comprehensively considering various real-time power utilization characteristic data, and determining a target mixing model based on the real-time multi-dimensional characteristic vector, so as to accurately output a target abnormal score through the target mixing model.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, device and medium for detecting abnormal power consumption based on a hybrid model. Background Technology

[0002] Abnormal electricity usage is prevalent globally, posing both safety hazards and contributing to electricity theft at an average rate of 6-8% annually. Traditional smart meters rely on threshold rules and physical safeguards (such as overcurrent alarms or magnet detection) for anomaly detection. However, these methods can only detect obvious anomalies (such as sudden current surges) and cannot identify complex electricity theft methods (such as harmonic injection or slow phase drift). Furthermore, they suffer from slow response times and high false alarm rates. Therefore, there is an urgent need for an intelligent detection method capable of identifying various abnormal electricity usage patterns and reducing false alarm rates. Summary of the Invention

[0003] One of the objectives of this invention is to provide a method, device, and medium for detecting abnormal power consumption based on a hybrid model.

[0004] According to one aspect of this application, an abnormal power consumption detection method based on a hybrid model is provided, the method comprising: Obtain real-time multidimensional feature vectors; The target mixture model is determined based on real-time multidimensional feature vectors, and the target anomaly score is output through the target mixture model; wherein, the target mixture model includes a first mixture model and / or a second mixture model, the first mixture model includes a first AE branch and a Tiny CNN branch; the second mixture model includes a second AE branch and a TCN branch; The target anomaly score is determined based on the target hybrid model.

[0005] According to another aspect of this application, a computer device for abnormal power consumption detection based on a hybrid model is provided, including a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed as described above.

[0006] According to another aspect of this application, a computer-readable storage medium is provided, storing a computer program that can be loaded by a processor and executed as described above.

[0007] Compared with existing technologies, this application obtains real-time multi-dimensional feature vectors and comprehensively considers various real-time electricity consumption feature data. Based on the real-time multi-dimensional feature vectors, a target hybrid model is determined from a first hybrid model and a second hybrid model. The real-time multi-dimensional feature vectors are then input into the target hybrid model to obtain a target anomaly score. Determining the target anomaly score through the target hybrid model significantly improves the accuracy of judging abnormal electricity consumption. Attached Figure Description

[0008] Figure 1 A flowchart of an abnormal power consumption detection method based on a hybrid model according to an embodiment of this application is shown; Figure 2 A schematic diagram of an abnormal power consumption detection device based on a hybrid model according to an embodiment of this application is shown; Figure 3 Exemplary systems that can be used to implement the various embodiments described in this application are shown. Detailed Implementation

[0009] The present application will now be described in further detail with reference to the accompanying drawings.

[0010] In a typical configuration of this application, the terminal, the service network device, and the trusted party all include one or more processors (e.g., a central processing unit (CPU), a dedicated processor (NPU)), input / output interfaces, network interfaces, and memory).

[0011] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory. Memory is an example of computer-readable media.

[0012] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PCM), programmable random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0013] The devices referred to in this application include, but are not limited to, terminals, network devices, or devices formed by integrating terminals and network devices through a network. The terminals include, but are not limited to, any mobile electronic product capable of human-computer interaction (e.g., via a touchpad), such as smartphones and tablets. These mobile electronic products can use any operating system, such as Android or iOS. The network devices include electronic devices capable of automatically performing numerical calculations and information processing according to pre-set or stored instructions. Their hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), and embedded devices. The network devices include, but are not limited to, computers, network hosts, single network servers, multiple network server clusters, or clouds composed of multiple servers. Here, a cloud consists of a large number of computers or network servers based on cloud computing, where cloud computing is a type of distributed computing, consisting of a virtual supercomputer composed of a group of loosely coupled computer clusters. The network includes, but is not limited to, the Internet, wide area network, metropolitan area network, local area network, VPN network, wireless ad hoc network, etc. Preferably, the device can also be a program running on the terminal, network device, or a device formed by integrating the terminal and network device, network device, touch terminal, or network device and touch terminal through a network.

[0014] Of course, those skilled in the art should understand that the above-described devices are merely examples, and other existing or future devices that are applicable to this application should also be included within the scope of protection of this application, and are hereby incorporated by reference.

[0015] In the description of this application, "multiple" means two or more, unless otherwise expressly and specifically defined.

[0016] refer to Figure 1This invention provides a flowchart of an abnormal power consumption detection method based on a hybrid model. The method includes steps S11, S12, and S13. In step S11, a real-time multidimensional feature vector is acquired; in step S12, a target hybrid model is determined based on the real-time multidimensional feature vector, and a target abnormality score is output through the target hybrid model; wherein, the target hybrid model includes a first hybrid model and / or a second hybrid model, the first hybrid model includes a first AE branch and a Tiny CNN branch; the second hybrid model includes a second AE branch and a TCN branch; in step S13, the target abnormality score is determined through the target hybrid model.

[0017] Specifically, in step S11, a real-time multi-dimensional feature vector is obtained. In some embodiments, the real-time multi-dimensional feature vector is obtained based on real-time electricity consumption features, which are obtained based on real-time electricity consumption data. In some embodiments, real-time electricity consumption features include, but are not limited to, time-domain features, frequency-domain features, statistical features, and event features. For a detailed explanation of this part, please refer to the corresponding embodiments below, which will not be repeated here. In this embodiment, abnormal electricity consumption is detected based on multi-dimensional electricity consumption data to achieve the technical effect of identifying various abnormal electricity consumption patterns.

[0018] In step S12, a target hybrid model is determined based on the real-time multidimensional feature vector, and the target anomaly score is output through the target hybrid model. The target hybrid model includes a first hybrid model and / or a second hybrid model. The first hybrid model includes a first AE branch and a Tiny CNN branch; the second hybrid model includes a second AE branch and a TCN branch. Those skilled in the art will understand that AE (Auto-encoder), as a type of artificial neural network containing an encoder and a decoder, is capable of unsupervised learning. Tiny CNN (Convolutional Neural Network) is a feedforward neural network that extracts local features through convolution and has a small number of parameters. TCN (Temporal Convolutional Network) is a deep learning model specifically designed for processing sequential data; it uses causal convolution and can capture long-term dependencies. In some embodiments, the target mixture model includes a first mixture model and a second mixture model. A target anomaly score is obtained by simultaneously inputting the real-time multidimensional feature vector into the first mixture model and the second mixture model, respectively (e.g., if the score output by the first mixture model is higher, then the score output by the first mixture model is used as the target anomaly score; if the score output by the second mixture model is higher, then the score output by the second mixture model is used as the target anomaly score). In some embodiments, the target mixture model is determined based on whether there are anomalous features in the real-time multidimensional feature vector and the feature type of the anomalous features (e.g., the target mixture model includes the first mixture model or the second mixture model). In other embodiments, to improve the accuracy of model inference, a lightweight autoencoder (AE) is first used to detect whether the first anomaly score of the real-time multidimensional feature vector is greater than a score threshold. If the first anomaly score is greater than the score threshold, the presence of anomalous features in the real-time multidimensional feature vector and the feature type of the anomalous features are detected to determine the target mixture model (e.g., the target mixture model includes the first mixture model or the second mixture model). For a detailed explanation of this part, please refer to the corresponding embodiments below; it will not be repeated here. In this embodiment, the target mixture model is automatically determined based on the real-time multidimensional feature vector, so that the real-time multidimensional feature vector is input into the corresponding target mixture model, thereby improving both prediction accuracy and efficiency.

[0019] In step S13, the target anomaly score is determined using a target fusion model. In some embodiments, the target fusion model includes a first fusion model and a second fusion model. The real-time multidimensional feature vector is simultaneously input into the first fusion model and the second fusion model, respectively, and the score with the higher score is taken as the target anomaly score. In other embodiments, the target fusion model includes either the first fusion model or the second fusion model, in which case the score output by either the first fusion model or the second fusion model is directly taken as the target anomaly score. In some embodiments, when the target fusion model includes both the first fusion model and the second fusion model, the current abnormal power consumption type can also be determined based on the target fusion model. The current abnormal power consumption type includes, but is not limited to, short-term high-frequency anomalies and long-term dependent anomalies. For example, the first fusion model corresponds to short-term high-frequency anomalies, and the second fusion model corresponds to long-term dependent anomalies. The system queries the database for abnormal power consumption types that have a mapping relationship with the target fusion model based on the target fusion model, and takes the abnormal power consumption type as the current abnormal power consumption type. For example, after determining the target fusion model, the current abnormal power consumption type can be determined based on the target fusion model. The real-time multidimensional feature vector is input into the target fusion model, and the target fusion model outputs the target anomaly score of the real-time multidimensional feature vector.

[0020] In some embodiments, step S11 includes: acquiring real-time electricity consumption data of the user through a smart meter; extracting real-time electricity consumption features based on the real-time electricity consumption data, wherein the real-time electricity consumption features include time-domain features, frequency-domain features, statistical features, and event features; and generating a real-time multi-dimensional feature vector based on the time-domain features, frequency-domain features, statistical features, and event features. In some embodiments, real-time electricity consumption data includes, but is not limited to, voltage waveforms, current waveforms, sensor data (e.g., magnetic field sensors, vibration / accelerometers, temperature and humidity sensors, etc.), and metadata (e.g., timestamps, device IDs, operating status, etc.). In some embodiments, time-domain features include, but are not limited to, active power (… Here, v(t) includes the instantaneous voltage value, i(t) includes the instantaneous current value, T includes the integration period, and P includes active power and reactive power. Here, v(t) includes the instantaneous voltage value. This includes the instantaneous current value with a 90-degree phase shift (T includes the integration period, Q includes reactive power), power factor (PF, the ratio of active power to apparent power, ranging from [0,1]), instantaneous fluctuation count (the number of sudden changes in current / voltage within a statistical window), and phase angle. Frequency domain characteristics include, but are not limited to, total harmonic distortion (THD, for example, calculating the ratio of each harmonic to the fundamental frequency). The data includes, but is not limited to, harmonic amplitudes (e.g., the amplitudes of the 3rd, 5th, and 7th harmonic currents extracted via FFT), and harmonic energy distribution (e.g., the energy percentage of a specific harmonic, such as the 3rd harmonic). Statistical features include, but are not limited to, mean and variance (average and fluctuation within a current / voltage window), quantile deviation (e.g., median absolute deviation (MAD) to enhance noise immunity), peak and trough techniques (to identify transient overshoot or drop events), and load averages (e.g., the windowed average of active power or current, such as the average within a 200ms window). Event features include, but are not limited to, sensor flags (e.g., magnetic field strength exceeding a threshold (0.5T), vibration count > 0, cover breakage switch triggering), and environmental data (e.g., abnormal temperature and humidity flags). In some embodiments, a real-time multidimensional feature vector is generated based on time-domain features, frequency-domain features, statistical features, and event features. For example, the real-time multidimensional feature vector x = [P, Q, RF, THD, ...]. , Load mean, variance, fluctuation count, magnetic field indicator, phase angle, etc.

[0021] In some embodiments, step S12 includes: simultaneously inputting the real-time multidimensional feature vector into a first mixture model and a second mixture model, respectively, wherein the target mixture model includes both the first mixture model and the second mixture model; or, inputting the real-time multidimensional feature vector into a lightweight autoencoder, and outputting a first anomaly score through the lightweight autoencoder; if the first anomaly score is greater than a score threshold, detecting whether there are anomalous features in the real-time multidimensional feature vector, and determining the target mixture model according to the feature type of the anomalous features, wherein the target mixture model includes either the first mixture model or the second mixture model; otherwise, continuing to monitor the real-time multidimensional feature vector in real time through the lightweight autoencoder. For example, both the first mixture model and the second mixture model can be used as the target mixture model, or one of the first mixture model and the second mixture model can be determined as the target mixture model. For relevant explanations when both the first mixture model and the second mixture model are used as the target mixture model, please refer to the corresponding embodiments above, which will not be repeated here. This embodiment focuses on the case where one of the first mixture model and the second mixture model is determined as the target mixture model. In some embodiments, only normal electricity consumption data is used to train the lightweight autoencoder AE to learn the "electricity consumption fingerprint" and minimize the reconstruction error. In some embodiments, normal electricity consumption data includes, but is not limited to, multidimensional feature vectors without abnormal features. In other words, each electricity consumption feature in the multidimensional feature vector falls within the normal range corresponding to that feature. For example, a large amount of normal electricity consumption data is input into a lightweight autoencoder (AE), which learns normal electricity consumption patterns through unsupervised learning. The training objective is to enable the AE to learn to compress and reconstruct the input data, thereby establishing a baseline "fingerprint" of normal electricity consumption. For example, the AE includes an encoder and a decoder. The encoder is used to compress the input as a latent representation z. Here, , This includes the encoder's weights and biases; Includes non-linear activation functions (such as ReLU, tanh); x includes the multi-dimensional feature vector of the input AE; , where k d represents the compressed latent representation. The decoder is used to reconstruct the output from the latent representation z. , Here, , Includes decoder weights and biases; output The goal is to approximate the original input x as closely as possible. The reconstruction error is minimized using the mean squared error (MSE). or The Adam optimizer is used to iteratively update the weights via gradient descent. Training continues until the loss converges. In this embodiment, in practical applications, the real-time multidimensional feature vector is first input into the lightweight autoencoder AE, which outputs a first anomaly score. If the first anomaly score is greater than a threshold, it indicates a possible abnormal power consumption. Then, the presence of anomalous features in the real-time multidimensional feature vector is detected, and the corresponding target mixture model is determined based on the feature type of the anomalous features. This allows for the accurate output of the target anomaly score and the current abnormal power consumption type through the corresponding target mixture model. For a detailed explanation of this part, please refer to the corresponding embodiment below; it will not be repeated here. In some embodiments, the models are periodically trained and updated due to factors such as season and user power consumption habits.

[0022] In some embodiments, the anomalous characteristics include at least one of the following: The peak harmonic value is greater than the peak threshold; in some embodiments, the peak threshold includes, but is not limited to, 0.5A. For example, the peak value of the third harmonic suddenly increases from the normal 0.1A to 0.8A.

[0023] The fluctuation count exceeds a counting threshold; in some embodiments, the technical threshold includes, but is not limited to, 10 fluctuations. For example, the number of current fluctuations increases from 5 times / window to 20 times / window.

[0024] The phase angle continues to shift; The average load has deviated from the normal baseline for an extended period. Of course, those skilled in the art will understand that the above-described abnormal features are merely examples, and other existing or future abnormal features that are applicable to this application are also within the scope of protection of this application and are incorporated herein by reference.

[0025] The target hybrid model is determined based on the feature type of the abnormal features, including: if the abnormal features include harmonic peak values ​​greater than the peak threshold and / or fluctuation counts greater than the count threshold, the feature type of the abnormal features is determined to be short-time high frequency, and a first hybrid model is determined as the target hybrid model; if the abnormal features include continuous phase angle shift and / or long-term deviation of the load average from the normal baseline, the feature type of the abnormal features is determined to be long-time dependent, and a second hybrid model is determined as the target hybrid model. In this embodiment, the feature type of the abnormal features in the real-time multidimensional feature vector determines the corresponding target hybrid model, so as to determine the target abnormal score based on the target hybrid model and improve the accuracy of judging abnormal power consumption.

[0026] In some embodiments, if the target hybrid model includes a first hybrid model, outputting a target anomaly score through the target hybrid model includes: the first AE branch compressing a real-time multidimensional feature vector into a latent representation through an encoder; the first AE branch reconstructing the real-time multidimensional feature vector through a decoder and outputting a first reconstruction error; the Tiny CNN branch extracting local features from the latent representation through a one-dimensional convolutional network; and dynamically fusing the first reconstruction error and local features through a dynamic fusion formula to obtain the target anomaly score; wherein the dynamic fusion formula includes: Here, y includes the target anomaly score. Including activation functions, Including the first reconstruction error, The fusion weights include the first reconstruction error, and h(s) includes the second anomaly score from the Tiny CNN branch output. The fusion weights, including the second anomaly score, include local features. The process of reconstructing the error from the first AE branch output is the same as or similar to the specific description of the lightweight autoencoder described above, and will not be repeated here. In this embodiment, in the first hybrid model, the reconstruction error obtained from the first AE branch and the second anomaly score obtained from the Tiny CNN branch are dynamically fused using a dynamic fusion formula, so as to combine the first AE branch and the Tiny CNN branch, making the target anomaly score obtained by the first hybrid model more accurate.

[0027] In some embodiments, if the target hybrid model includes a second hybrid model, outputting a target anomaly score through the target hybrid model includes: the second AE branch compressing a real-time multidimensional feature vector into a latent representation through an encoder; the second AE branch reconstructing the real-time multidimensional feature vector through a decoder and outputting a second reconstruction error; the TCN branch performing temporal analysis on the latent representation through an dilated convolutional network to obtain a feature map; and dynamically fusing the second reconstruction error and the feature map through a dynamic fusion formula to obtain the target anomaly score; wherein the dynamic fusion formula includes: Here, y includes the target anomaly score. Including the second activation function, Including the second reconstruction error, Including the fusion weights of the second reconstruction error, Including the third anomaly score from the TCN branch output, Including the fusion weight of the third anomaly score, This includes feature maps. The process of reconstructing the error from the second AE branch is the same as or similar to the specific description of the lightweight autoencoder described above, and will not be repeated here. In this embodiment, in the second hybrid model, a dynamic fusion formula is used to dynamically fuse the reconstruction error obtained from the second AE branch and the third anomaly score obtained from the TCN branch, so as to combine the second AE branch and the TCN branch and make the target anomaly score obtained by the second hybrid model more accurate.

[0028] In some embodiments, the first hybrid model is obtained by first training a first AE branch of the first hybrid model using normal training sample data to fix the AE parameters of the first AE branch; then, based on the fixed AE parameters, training a TinyCNN branch using normal training sample data and short-term high-frequency anomalous sample data. Similar to or analogous to the first hybrid model, the second hybrid model also trains a second AE branch using normal training sample data to fix the AE parameters of the second AE branch; then, based on the fixed AE parameters, training a TCN branch using normal training sample data and long-term dependent anomalous sample data.

[0029] Figure 2 A schematic diagram of an abnormal power consumption detection device based on a hybrid model according to an embodiment of this application is shown. The device includes a first module, a second module, and a third module. The first module is used to acquire real-time multidimensional feature vectors; the second module is used to determine a target hybrid model based on the real-time multidimensional feature vectors and output a target anomaly score through the target hybrid model; wherein, the target hybrid model includes a first hybrid model and / or a second hybrid model, the first hybrid model includes a first AE branch and a Tiny CNN branch; the second hybrid model includes a second AE branch and a TCN branch; the third module is used to determine the target anomaly score through the target hybrid model.

[0030] Here, the specific implementation methods corresponding to Module 1, Module 2, and Module 3 are the same as or similar to the specific embodiments of steps S11, S12, and S13 above, and therefore will not be repeated here, but are included by reference.

[0031] In addition to the methods and devices described in the above embodiments, this application also provides a computer-readable storage medium storing computer code that, when executed, performs the method described in any of the preceding embodiments.

[0032] This application also provides a computer program product that, when executed by a computer device, performs the method described in any of the preceding claims.

[0033] This application also provides a computer device, the computer device comprising: One or more processors; Memory, used to store one or more computer programs; When the one or more computer programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the method as described in any of the preceding methods.

[0034] Figure 3 Exemplary systems that can be used to implement the various embodiments described in this application are shown; like Figure 3 As shown in some embodiments, system 300 can function as any of the devices described in each of the embodiments. In some embodiments, system 300 may include one or more computer-readable media having instructions (e.g., system memory or NVM / storage device 320) and one or more processors (e.g., one or more processors 305) coupled to the one or more computer-readable media and configured to execute the instructions to implement the module and thus perform the actions described in this application.

[0035] In one embodiment, the system control module 310 may include any suitable interface controller to provide any suitable interface to at least one of the processors 305 and / or any suitable device or component communicating with the system control module 310.

[0036] The system control module 310 may include a memory controller module 330 to provide an interface to the system memory 315. The memory controller module 330 may be a hardware module, a software module, and / or a firmware module.

[0037] System memory 315 can be used, for example, to load and store data and / or instructions for system 300. In one embodiment, system memory 315 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, system memory 315 may include double data rate type quad synchronous dynamic random access memory (DDR4 SDRAM).

[0038] In one embodiment, the system control module 310 may include one or more input / output (I / O) controllers to provide interfaces to the NVM / storage device 320 and (one or more) communication interfaces 325.

[0039] For example, NVM / storage device 320 may be used to store data and / or instructions. NVM / storage device 320 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drives (HDDs), one or more optical disc drives (CDs), and / or one or more digital universal optical disc (DVD) drives).

[0040] NVM / storage device 320 may include storage resources that are physically part of a device on which system 300 is mounted, or that can be accessed by the device without necessarily being part of it. For example, NVM / storage device 320 may be accessed via a network through one or more communication interfaces 325.

[0041] One or more communication interfaces 325 may provide the system 300 with an interface to communicate over one or more networks and / or with any other suitable device. The system 300 may wirelessly communicate with one or more components of a wireless network in accordance with any of one or more wireless network standards and / or protocols.

[0042] In one embodiment, at least one of the processors 305 may be logically packaged with one or more controllers of the system control module 310 (e.g., memory controller module 330). In one embodiment, at least one of the processors 305 may be logically packaged with one or more controllers of the system control module 310 to form a system-in-package (SiP). In one embodiment, at least one of the processors 305 may be integrated with the logic of one or more controllers of the system control module 310 on the same die. In one embodiment, at least one of the processors 305 may be integrated with the logic of one or more controllers of the system control module 310 on the same die to form a system-on-a-chip (SoC).

[0043] In various embodiments, system 300 may be, but is not limited to, a server, workstation, desktop computing device, or mobile computing device (e.g., laptop computing device, handheld computing device, tablet computer, netbook, etc.). In various embodiments, system 300 may have more or fewer components and / or different architectures. For example, in some embodiments, system 300 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0044] It should be noted that this application can be implemented in software and / or a combination of software and hardware, for example, using an application-specific integrated circuit (ASIC), a general-purpose computer, or any other similar hardware device. In one embodiment, the software program of this application can be executed by a processor to implement the steps or functions described above. Similarly, the software program of this application (including related data structures) can be stored in a computer-readable recording medium, such as RAM memory, a magnetic or optical drive, a floppy disk, or similar devices. Furthermore, some steps or functions of this application can be implemented in hardware, for example, as circuitry that cooperates with a processor to perform the various steps or functions.

[0045] Furthermore, a portion of this application can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to this application through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0046] Communication media include media through which communication signals containing, for example, computer-readable instructions, data structures, program modules, or other data are transmitted from one system to another. Communication media can include guided transmission media (such as cables and wires (e.g., optical fibers, coaxial cables, etc.)) and wireless (unguided transmission) media capable of propagating energy waves, such as sound, electromagnetic, RF, microwave, and infrared. Computer-readable instructions, data structures, program modules, or other data can be embodied as modulated data signals in, for example, wireless media (such as carrier waves or similar mechanisms embodied as part of spread spectrum technology). The term "modulated data signal" refers to a signal whose one or more characteristics are altered or set in a manner that encodes information in the signal. Modulation can be analog, digital, or a hybrid modulation technique.

[0047] By way of example and not limitation, computer-readable storage media may include volatile and non-volatile, removable and non-removable media implemented by any method or technique for storing information such as computer-readable instructions, data structures, program modules or other data. For example, computer-readable storage media include, but are not limited to, volatile memories such as random access memory (RAM, DRAM, SRAM); and non-volatile memories such as flash memory, various read-only memories (ROM, PROM, EPROM, EEPROM), magnetic and ferromagnetic / ferroelectric memories (MRAM, FeRAM); and magnetic and optical storage devices (hard disks, magnetic tapes, CDs, DVDs); or other media now known or hereafter developed capable of storing computer-readable information / data for use by a computer system.

[0048] Herein, one embodiment of this application includes an apparatus comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the apparatus is triggered to run a method and / or technical solution based on the foregoing embodiments of this application.

[0049] It will be apparent to those skilled in the art that this application is not limited to the details of the exemplary embodiments described above, and that this application can be implemented in other specific forms without departing from the spirit or essential characteristics of this application. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within this application. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in the apparatus claims may also be implemented by a single unit or device in software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any particular order.

Claims

1. A hybrid model-based abnormal electricity usage detection method, characterized in that, The method comprises: acquiring a real-time multi-dimensional feature vector; determining a target hybrid model according to the real-time multi-dimensional feature vector, and outputting a target anomaly score through the target hybrid model; wherein the target hybrid model comprises a first hybrid model and / or a second hybrid model, the first hybrid model comprises a first AE branch and a Tiny CNN branch, and the second hybrid model comprises a second AE branch and a TCN branch; determining a target anomaly score through the target hybrid model.

2. The method of claim 1, wherein, The acquisition of the real-time multi-dimensional feature vector comprises: acquiring real-time power consumption data of a user through a smart meter; extracting real-time power consumption features according to the real-time power consumption data, wherein the real-time power consumption features comprise time domain features, frequency domain features, statistical features, and event features; generating the real-time multi-dimensional feature vector according to the time domain features, the frequency domain features, the statistical features, and the event features.

3. The method of claim 1, wherein, The determination of the target hybrid model according to the real-time multi-dimensional feature vector and the output of the target anomaly score through the target hybrid model comprise: simultaneously inputting the real-time multi-dimensional feature vector into the first hybrid model and the second hybrid model, wherein the target hybrid model comprises the first hybrid model and the second hybrid model; or inputting the real-time multi-dimensional feature vector into a lightweight autoencoder, and outputting a first anomaly score through the lightweight autoencoder; if the first anomaly score is greater than a score threshold, detecting whether there is an abnormal feature in the real-time multi-dimensional feature vector, and determining a target hybrid model according to a feature type of the abnormal feature, wherein the target hybrid model comprises the first hybrid model or the second hybrid model; otherwise, continuing to monitor the real-time multi-dimensional feature vector in real time through the lightweight autoencoder.

4. The method of claim 3, wherein, The abnormal feature comprises at least one of the following: a harmonic peak value greater than a peak threshold value; a fluctuation count greater than a count threshold value; a phase angle continuously deviating; a load mean value deviating from a normal baseline for a long time; The determination of the target hybrid model according to the feature type of the abnormal feature comprises: if the abnormal feature comprises the harmonic peak value greater than the peak threshold value and / or the fluctuation count greater than the count threshold value, determining that the feature type of the abnormal feature is short-time high-frequency, and determining that the first hybrid model is used as the target hybrid model; if the abnormal feature comprises the phase angle continuously deviating and / or the load mean value deviating from the normal baseline for a long time, determining that the feature type of the abnormal feature is long-time dependent, and determining that the second hybrid model is used as the target hybrid model.

5. The method of claim 1, wherein, If the target hybrid model comprises the first hybrid model, the output of the target anomaly score through the target hybrid model comprises: the first AE branch compresses the real-time multi-dimensional feature vector into a latent representation through an encoder, and reconstructs the real-time multi-dimensional feature vector through a decoder to output a first reconstruction error; the Tiny CNN branch extracts local features from the latent representation through a one-dimensional convolutional network; The first reconstruction error and the local feature are dynamically fused through a dynamic fusion formula to obtain the target anomaly score; wherein the dynamic fusion formula comprises: Here, y includes the target anomaly score, including a first activation function, including the first reconstruction error, including a fusion weight of the first reconstruction error, h(s) includes a second anomaly score output by the Tiny CNN branch, including a fusion weight of the second anomaly score, and s includes the local feature.

6. The method of claim 1, wherein, if the target hybrid model comprises the second hybrid model, the output of the target anomaly score through the target hybrid model comprises: The second AE branch compresses the real-time multi-dimensional feature vector into a latent representation through an encoder, and reconstructs the real-time multi-dimensional feature vector through a decoder to output a second reconstruction error; The TCN branch performs time series analysis on the latent representation through an expanded convolutional network to obtain a feature map; The second reconstruction error and the feature map are dynamically fused through a dynamic fusion formula to obtain the target anomaly score; wherein the dynamic fusion formula comprises: Here, y includes the target anomaly score, including a second activation function, including the second reconstruction error, including a fusion weight of the second reconstruction error, including a third anomaly score output by the TCN branch, including a fusion weight of the third anomaly score, including the feature map.

7. The method of claim 1, wherein, The first hybrid model is obtained by the following method: First, train the first AE branch of the first hybrid model through normal training sample data to fix the AE parameters of the first AE branch; On the basis of the fixed AE parameters, train the Tiny CNN branch through the normal training sample data and short-time high-frequency abnormal sample data.

8. The method of claim 1, wherein, The second hybrid model is obtained by the following method: First, train the second AE branch of the second hybrid model through normal training sample data to fix the AE parameters of the second AE branch; On the basis of the fixed AE parameters, train the TCN branch through the normal training sample data and long-time dependence abnormal sample data.

9. A computer device, comprising: A memory and a processor are included, and the memory stores a hybrid model-based abnormal power consumption detection method capable of being loaded and executed by the processor, as claimed in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, A memory stores a hybrid model-based abnormal power consumption detection method capable of being loaded and executed by the processor, as claimed in any one of claims 1 to 8.

Images