Network-related fixed value anomaly detection method, system and device based on improved SOM-DAGMM and medium

Abstract

The invention relates to the technical field of power system relay protection constant value detection, and discloses a network-related constant value anomaly detection method, system and device based on an improved SOM-DAGMM, and a medium, and the method comprises the steps: introducing an improved SOM-DAGMM model, employing a depth sparse auto-encoder to extract deep representation, maintaining a feature topological structure through self-organization mapping, and carrying out the detection of the network-related constant value anomaly. And carrying out probability density estimation by combining a Gaussian mixture model, and embedding operation logics such as main-standby matching and constant value ladder property of the power system into a loss function in a constraint function form to carry out joint optimization. The model not only can accurately detect the numerical value abnormity of the constant value parameter, but also can identify the complex logic conflict and matching mismatch problems, can realize the accurate discrimination and positioning of the abnormity type through the comprehensive evaluation of the energy score and the constraint violation degree, remarkably improves the accuracy and reliability of the constant value checking, and improves the accuracy and reliability of the constant value checking. Safety accidents such as protection system maloperation and operation refusal caused by fixed value errors are effectively prevented, and key technical support is provided for safe and stable operation of a power grid.

Description

Technical Field

[0001] This invention relates to the field of power system relay protection setting detection technology, and in particular to a method, system, equipment and medium for detecting grid-connected setting anomalies based on an improved SOM-DAGMM. Background Technology

[0002] As the first line of defense for ensuring the stable operation of the power grid, the accuracy of relay protection settings directly affects the coordination between power generation units and the main grid, and is crucial to preventing local faults from escalating into system accidents. For a long time, setting verification has been the foundation for the accurate performance of grid protection functions, relying on the traditional model of manual experience, procedural clauses, and offline simulation. This approach suffers from drawbacks such as low efficiency and untimely verification, failing to meet the needs of high-quality development. With the evolution of new power systems towards higher dimensions, nonlinearity, and multimodality, and the increasing complexity of structures including high proportions of new energy sources and DC hybrid connections, the limitations of traditional methods in handling complex grid protection operation data are becoming increasingly apparent. This is mainly reflected in the difficulty of capturing all interaction patterns from massive and diverse grid connection point operation data; and the poor adaptability of offline simulation to new system architectures, failing to accurately reflect the dynamic coupling characteristics between grid-connected equipment and the grid. Furthermore, when grid protection settings become abnormal, traditional methods lack effective interpretable analysis tools, resulting in low fault location efficiency, and real-time online verification and dynamic adjustment are unrealistic, leading to the continuous accumulation of hidden dangers to power grid safety.

[0003] New algorithms such as machine learning methods and support vector machines have also attempted to enter the field of power grid protection, but they often fall into new predicaments due to their own limitations. This is mainly because most methods assume that the data follows a single distribution, making it difficult to adapt to the complex data ecosystem of power grid protection systems under multiple operating conditions and modes. Statistical models lack physical constraints, and occasional misjudgments that violate the operating rules of the power system may threaten power grid security. In addition, model updates are difficult to keep up with the dynamic adjustment rhythm of power grid structure and operating mode, which reduces the value of the technology application. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a method, system, device, and medium for detecting anomalies in grid-connected settings based on an improved SOM-DAGMM to solve the problems of difficulty in fully capturing the high-dimensional and nonlinear characteristics of grid-connected settings under multiple operating modes, the inability to match the unique grid-connected logic constraints of power systems, high false alarm rates, and insufficient interpretability.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a method for detecting network-related setpoint anomalies based on an improved SOM-DAGMM, comprising: Obtain historical network protection setting data within the region; Extract the feature parameters from the fixed-value data, perform data preprocessing, and obtain the first fixed-value dataset; Construct a SOM-DAGMM model; using the self-organizing map algorithm and the first set of fixed values ​​as training samples, construct a topology mapping model and extract the topology feature vectors of the network protection set values; The first fixed-value dataset is input into the deep sparse autoencoder in the model, and the first joint feature vector is obtained through the decoder. By combining the first joint feature vector with the topological feature vector of the network protection setting, a second joint feature vector is generated. The second joint feature vector is then input into the estimation network of the model, and the posterior probability of the sample belonging to each Gaussian component is output. Construct a comprehensive loss function, and jointly optimize the deep sparse autoencoder and estimate network parameters based on the posterior probability through backpropagation until the model converges. Based on the optimized model, forward computation is performed on the first fixed-value input dataset to obtain the loss function of reconstruction error, energy score and logical violation degree; Based on the loss function of reconstruction error, energy score and logical violation degree, a comprehensive anomaly score and anomaly judgment threshold are set; Input the data to be verified into the optimized model, calculate the comprehensive anomaly score, and combine it with the anomaly judgment threshold to determine the status and anomaly type.

[0007] As a preferred embodiment of the network protection setting anomaly detection method based on the improved SOM-DAGMM described in this invention, the method comprises: constructing a topology mapping model using a first setting dataset as training samples through a self-organizing mapping algorithm, and extracting the topology feature vector of the network protection setting, including: Based on the first set value dataset and the network protection set value dimension, a protection set value feature space of the network protection system is constructed. Define a Each grid node of the two-dimensional grid Each has a feature related to the input. Weight vectors of the same dimension ; Calculate the feature vector of each input in the first fixed-value dataset. The Euclidean distance between the unit and the weight vectors of all nodes is used to find the best matching unit. Update and iterate the weights of all nodes until the topology mapping model converges; For each sample in the first fixed-value dataset, the coordinates of the corresponding best-matching unit in the grid are obtained. Calculate the Euclidean distance from each sample to the corresponding best-matching unit. and to the corresponding The average distance of the nearest best-matching units together constitutes the topological feature vector of the network protection setting. .

[0008] As a preferred embodiment of the network-related fixed-value anomaly detection method based on the improved SOM-DAGMM described in this invention, the method involves: inputting a first fixed-value dataset into a deep sparse autoencoder in the model, and obtaining a first joint feature vector through a decoder, including: Based on a deep autoencoder, sparse regularization is introduced to obtain each hidden unit. The average activation value; By adding KL divergence constraints and setting the loss function of the encoder compression network, a fully defined deep sparse autoencoder is obtained. The first fixed-value dataset is input into the configured deep sparse autoencoder to obtain compressed features. ; The compressed features are processed by a decoder to obtain the reconstructed vector and reconstruction error. ; The first joint feature vector is generated by combining the compressed features and the reconstruction error. .

[0009] As a preferred embodiment of the network protection setting anomaly detection method based on the improved SOM-DAGMM described in this invention, the method comprises: combining the first joint feature vector with the topological feature vector of the network protection setting to generate a second joint feature vector; inputting the second joint feature vector into the estimation network of the model; and outputting the posterior probability of the sample belonging to each Gaussian component, including: The first joint feature vector Topological feature vectors related to network protection settings By combining them, we obtain the second joint feature vector. ; The second joint feature vector Input to a multi-layer MLP, connection The function outputs the estimated posterior probability that the corresponding fixed data belongs to each Gaussian component. ; Based on posterior probability Calculate and update the parameters of the estimated network part in DAGMM.

[0010] As a preferred embodiment of the improved SOM-DAGMM-based network setpoint anomaly detection method described in this invention, the method includes: constructing a comprehensive loss function, which includes: the loss function of the compressed network, the energy function of the Gaussian mixture model, and the power logic constraint loss. The loss function of the compressed network includes the reconstruction error of the compressed network, the KL divergence constraint function, and L2 regularization. The energy function of the Gaussian mixture model is calculated from the parameters of the estimated network model. The parameters of the Gaussian mixture model include the first... The mixing coefficient of the individual Gaussian distribution, the first The mean and variance parameters of the individual Gaussian distribution; Among them, the power logic constraint loss is determined by setting several protection setting verification logic constraint functions. And obtained by combining a differentiable penalty function.

[0011] As a preferred embodiment of the improved SOM-DAGMM-based network setting anomaly detection method described in this invention, the power logic constraint loss is achieved by setting several logic constraint functions for protection setting verification. And combined with a differentiable penalty function, it is obtained, including: The primary and backup order constraints, upper and lower limit constraints, and directional constraints are set through logical natural language, and the degree of violation of each constraint is set through mathematical form; pass The function is represented as: ;

[0012] in, It is the number of constraint rules; for each class coefficient Based on expert experience; For the first The degree of violation of the logical constraints, It is added as a regularization term to the total loss function.

[0013] As a preferred embodiment of the network-related fixed-value anomaly detection method based on the improved SOM-DAGMM described in this invention, the method includes: jointly optimizing the deep sparse autoencoder and estimating network parameters through backpropagation, including: Solve for the gradient of the comprehensive loss function; Gradients are naturally assigned to the deep sparse autoencoder and the estimation network; After multiple iterations, the deep sparse autoencoder is updated using Adam, and all parameters in the network are estimated until the network loss converges.

[0014] Secondly, the present invention provides a network-related fixed value anomaly detection system based on an improved SOM-DAGMM, comprising: The acquisition module is used to acquire historical network protection setting data within the region; The preprocessing module is used to extract feature parameters from the fixed-value data, perform data preprocessing, and obtain the first fixed-value dataset. The first feature extraction module is used to construct the SOM-DAGMM model. It uses the self-organizing mapping algorithm and the first fixed value dataset as training samples to construct a topology mapping model and extract the topology feature vector of the network protection fixed value. The second feature extraction module is used to input the first fixed-value dataset into the deep sparse autoencoder in the model and obtain the first joint feature vector through the decoder. The joint input-output module is used to combine the first joint feature vector with the topological feature vector of the network protection setting to generate a second joint feature vector, input the second joint feature vector into the estimation network of the model, and output the posterior probability of the sample belonging to each Gaussian component. The update module is used to construct the comprehensive loss function, which jointly optimizes the deep sparse autoencoder and estimates the network parameters based on the posterior probability through backpropagation until the model converges. The first calculation module is used to perform forward calculations on the first fixed-value dataset based on the optimized model to obtain a loss function that includes reconstruction error, energy score, and degree of logical violation. The second calculation module is used to set the comprehensive anomaly score and anomaly judgment threshold based on the loss function of reconstruction error, energy score and logical violation degree; The judgment module is used to input the setpoint data to be verified into the optimized model, calculate the comprehensive anomaly score, and determine the status and anomaly type by combining the anomaly judgment threshold.

[0015] Thirdly, the present invention provides a computer device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of a network-related value anomaly detection method based on an improved SOM-DAGMM.

[0016] Fourthly, the present invention provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the network-related value anomaly detection method based on an improved SOM-DAGMM.

[0017] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention fully considers the characteristics of power grid protection setting data, such as high dimensionality, multi-feature coupling, and strong logical constraints. Different voltage levels, line types, and protection configurations lead to complex distribution characteristics of setting parameters in the feature space. By introducing an improved self-organizing mapping algorithm—Deep Autoencoder Gaussian Mixture Model (SOM-DAGMM)—a deep sparse autoencoder is used to extract deep representations, self-organizing mapping is used to maintain the feature topology, and probability density estimation is performed in conjunction with the Gaussian mixture model. Simultaneously, the operational logic of power system primary / backup coordination and setting step characteristics are embedded into the loss function as constraint functions for joint optimization. This model can not only accurately detect numerical anomalies in setting parameters but also identify complex logical conflicts and coordination mismatches. Through a comprehensive evaluation of energy scores and constraint violation degrees, it can achieve accurate identification and location of anomaly types, significantly improving the accuracy and reliability of setting verification, effectively preventing safety accidents such as maloperation and failure to operate of protection systems due to setting errors, and providing key technical support for the safe and stable operation of the power grid. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the overall process of a network-related value anomaly detection method based on an improved SOM-DAGMM according to an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of the total loss convergence curve in a network-related fixed-value anomaly detection based on an improved SOM-DAGMM according to an embodiment of the present invention.

[0021] Figure 3 This is a schematic diagram of the reconstruction loss convergence curve in network-related value anomaly detection based on an improved SOM-DAGMM, according to an embodiment of the present invention.

[0022] Figure 4 This is a schematic diagram of the convergence curve of the logic constraint loss in a network-related value anomaly detection based on an improved SOM-DAGMM, according to an embodiment of the present invention.

[0023] Figure 5 This is a schematic diagram of the sparsity loss convergence curve in a network-related value anomaly detection based on an improved SOM-DAGMM according to an embodiment of the present invention.

[0024] Figure 6This is a schematic diagram of an anomaly score sequence in network-related fixed-value anomaly detection based on an improved SOM-DAGMM, according to an embodiment of the present invention.

[0025] Figure 7 This is a schematic diagram of the anomaly score distribution in a network-related fixed-value anomaly detection based on an improved SOM-DAGMM according to an embodiment of the present invention.

[0026] Figure 8 This is a schematic diagram of anomaly detection results in a network-related fixed value anomaly detection based on an improved SOM-DAGMM according to an embodiment of the present invention. Detailed Implementation

[0027] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0028] Example 1, referring to Figure 1 As an embodiment of the present invention, a method for detecting network-related setpoint anomalies based on an improved SOM-DAGMM is provided, comprising: S100: Obtain historical network protection setting data within the region; S200: Extract feature parameters from the fixed-value data, perform data preprocessing, and obtain the first fixed-value dataset; S300: Construct a SOM-DAGMM model, and use the self-organizing mapping algorithm with the first fixed value dataset as training samples to construct a topology mapping model and extract the topology feature vector of the network protection fixed value; S400: Input the first fixed-value dataset into the deep sparse autoencoder in the model, and obtain the first joint feature vector through the decoder; S500: Combine the first joint feature vector with the topological feature vector of the network protection setting to generate the second joint feature vector. Input the second joint feature vector into the estimation network of the model and output the posterior probability of the sample belonging to each Gaussian component. S600: Construct a comprehensive loss function, and jointly optimize the deep sparse autoencoder and estimate network parameters based on the posterior probability through backpropagation until the model converges; S700: Based on the optimized model, forward computation is performed on the first fixed-value input dataset to obtain the loss function of reconstruction error, energy score and logical violation degree; S800: Based on the loss function of reconstruction error, energy score and logic violation degree, set the comprehensive anomaly score and anomaly judgment threshold; S900: Input the setpoint data to be verified into the optimized model, calculate the comprehensive anomaly score, and determine the status and anomaly type by combining the anomaly judgment threshold.

[0029] It should be noted that in actual operation, due to improper human operation, data entry errors, equipment performance degradation, or changes in system operation mode, abnormal situations often occur where the grid protection settings deviate from the reasonable range, posing a serious threat to the reliability of the grid protection system. Such abnormalities can cause grid protection devices to malfunction or fail to operate, which may not only damage power generation equipment but also trigger systemic risks such as unit disconnection from the grid, power oscillations, local voltage collapse, and even regional power outages, severely weakening the continuity and safety level of the power grid.

[0030] In complex power grids with a high proportion of renewable energy integration, the accuracy, coordination, and consistency of grid-connected protection settings directly affect the safety and stability boundaries during the interaction between the generation side and the grid. Most existing methods for detecting anomalies in settings are based on autoencoders and clustering models in deep learning. While Deep Autoencoder Gaussian Mixture Models (DAGMMs) have improved anomaly detection capabilities to some extent, they still suffer from limited feature compression capabilities of single autoencoders in grid-connected protection applications. Furthermore, they lack selective coordination between primary and backup protection systems, sensitivity coordination, and strategic linkage with grid stability control. Additionally, they lack the embedding and utilization of prior knowledge such as industry regulations and operational experience, resulting in insufficient interpretability of the model's potential space in real-world grid-connected scenarios, inadequate utilization of prior grid-connected knowledge, and a high false alarm rate.

[0031] Therefore, to address the aforementioned main issues, steps S100-S900 are designed to integrate deep feature extraction, structural clustering, and grid-related rule embedding to achieve a high-precision, interpretable, and adaptive setpoint anomaly detection and dynamic verification function, ensuring the setpoint reliability and operational safety at the interface between the power generation unit and the power grid, and supporting the overall reliable operation of the power grid.

[0032] Example 2, refer to Figures 1-8 As an embodiment of the present invention, based on the above embodiment, a method for detecting network-related fixed value anomalies based on an improved SOM-DAGMM is provided.

[0033] In this embodiment of the application, in S100, the historical network protection setting data of the region is obtained; Specifically, in the study of abnormal setting value detection in regional power grids, the setting value data usually covers multiple parameters, such as current threshold, voltage setting value and time setting value.

[0034] In this embodiment of the application, in S200, feature parameters are extracted from the fixed value data, and data preprocessing is performed to obtain the first fixed value dataset; Specifically, the various parameters obtained often differ significantly in numerical range and units. If modeling is performed directly based on the raw data, certain features with larger values ​​may overly dominate the model training process, thereby affecting the accuracy of anomaly detection.

[0035] Therefore, in S200, the Z-score normalization method can be used for preprocessing of fixed-value single data. This maps each feature value to a specific interval proportionally, effectively avoiding model bias caused by differences in feature scales while preserving the relative structure of the original data distribution. The normalization calculation formula is shown below: ;

[0036] in, The original data values ​​obtained; These are the mean and standard deviation of the entire feature dataset, respectively. The value is the normalized value.

[0037] It should be noted that after this type of normalization processing in S200, all fixed-value data are constrained within a uniform range. This not only improves the stability of subsequent model training and the efficiency of anomaly detection, but also enhances the interpretability and visualization of the results. Furthermore, based on the normalized data, some anomalous fixed-value items can be observed more clearly. Normal fixed-value data can be directly filtered out, and based on expert experience, the most important multidimensional (up to 80 dimensions) fixed-value items can be selected as data input, providing a high-quality data foundation for subsequent model construction.

[0038] In addition, the protection setting sheet data may also contain setting items such as protection control words and soft pressure plates. Control words are binary data units widely used in the power industry. Their function is to control whether the protection setting is effective. Each protection control word or soft pressure plate controls one or more protection settings. For example, "Distance Protection Section I" controls whether "Ground Distance Section I Setting" and "Phase-to-Phase Distance Section I Setting" are effective. If "Distance Protection Section I" is 1, the corresponding protection setting is effective; otherwise, it is ineffective. Therefore, the protection setting data in the protection setting sheets of different power plants exhibits significant regionality and sparsity. This also provides a knowledge foundation for subsequent SOM dimensionality reduction clustering to extract topological feature vectors and using sparse encoders to extract low-dimensional representations for anomaly detection.

[0039] S300: Construct the SOM-DAGMM model; using the self-organizing mapping algorithm and the first fixed-value dataset as training samples, construct a topology mapping model and extract the topology feature vectors of the network protection fixed values; Specifically, SOM-DAGMM adds SOM to the DAGMM framework for dimensionality reduction and initial clustering to obtain more low-dimensional representation features from single data.

[0040] Before detailing the S300 steps, let's first introduce the Self-Organizing Map (SOM) algorithm, which is a type of artificial neural network and belongs to the category of unsupervised learning algorithms. The SOM neural network can automatically cluster and reduce the dimensionality of input data by learning from it, mapping high-dimensional data to a low-dimensional space (usually a two-dimensional grid structure) while preserving the topological relationships of the data in the high-dimensional space.

[0041] In this embodiment of the application, S300 uses a self-organizing mapping algorithm to construct a topology mapping model using the first fixed-value dataset as training samples, and extracts the topology feature vectors of the network protection fixed values, including the following steps A1-A5: A1: Based on the first setpoint dataset and the network protection setpoint dimension, construct the protection setpoint feature space of the network protection system; A2: Define a A two-dimensional grid of (number of rows * number of columns), with each grid node... (That is: neurons) all have a feature related to the input. Weight vectors of the same dimension ; Specifically, weight vector Random initialization can be used.

[0042] It should be noted that step A2 is based on the feature space constructed in step A1 to build a self-organizing map neural network model.

[0043] A3: Calculate the feature vector for each input in the first fixed-value dataset. The Euclidean distance between the unit and the weight vectors of all nodes is used to find the best matching unit. Specifically, Euclidean distance Represented as: ; The neural node with the smallest distance is selected as the best matching unit.

[0044] A4: Update and iterate the weights of all nodes until the topology mapping model converges; Specifically, the weight vectors of neurons within a preset neighborhood radius can be updated. The magnitude of the update for each neuron node is calculated using a Gaussian kernel function, so that the updated weight vectors approximate the direction of the input sample. The weight update is implemented using the following formula: ; In the formula, Indicates the number of training iterations Time neuron The weight vector is the input sample; Indicates the number of training iterations Time neuron The weight vector; The learning rate function decays over time; The neighborhood function is based on the Gaussian kernel function, and its specific formula is as follows: ; In the formula, and They represent neurons respectively. The coordinates of the best-matched unit (BMU) on the output layer 2D grid; This indicates the expected value calculation; The Euclidean distance between the two neurons; The neighborhood radius decays over time, and its update rule is as follows: In the formula, This is the initial neighborhood radius (usually set to 1 / 2 to 2 / 3 of the grid radius). The preset total number of training iterations is gradually reduced as training progresses, thereby gradually tightening the updated neighborhood range.

[0045] A5: For each sample in the first fixed-value dataset, the coordinates of the corresponding best-matching unit in the grid are obtained. Calculate the Euclidean distance from each sample to the corresponding best-matching unit. and to the corresponding The average distance of the nearest best-matching units together constitutes the topological feature vector of the network protection setting. .

[0046] Specifically, steps A3 and A4 need to be repeated until the network converges, and until the preset total number of training iterations is reached. After training, the coordinates of the best-matching unit in the grid are obtained. .

[0047] Specifically, .in, Indicates the sample up to its number The Euclidean distance between the best-matching units of the nearest neighbors.

[0048] S400: Input the first fixed-value dataset into the deep sparse autoencoder in the model, and obtain the first joint feature vector through the decoder; Before detailing the S400 steps, let's introduce the DAGMM model, an end-to-end anomaly detection framework combining deep learning and statistical models. Its core idea is to utilize a deep autoencoder for nonlinear dimensionality reduction and feature learning, and then use a Gaussian mixture model to model the distribution of "normal" data in a low-dimensional space. Anomaly detection hinges on density estimation, but high-dimensional data suffers from the curse of dimensionality. To address this, dimensionality reduction is typically performed first, followed by density estimation in the latent low-dimensional space, and finally, anomaly samples are selected based on the energy function in the GMM.

[0049] The model mainly consists of two modules. The first part is a compression network, which is a standard deep autoencoder responsible for feature extraction and dimensionality reduction of high-dimensional input data. It compresses and reconstructs fixed-value data from the input data, outputting a low-dimensional representation of the fixed-value data features and the reconstruction error. The encoder and decoder typically use symmetric fully connected layers with activation functions.

[0050] The present invention employs a depth sparse encoder to replace the traditional depth autoencoder, and the specific details are as follows.

[0051] In this embodiment of the application, step S400 involves inputting the first fixed-value dataset into the deep sparse autoencoder in the model and obtaining the first joint feature vector through the decoder, including the following steps B1-B5: B1: Based on a deep autoencoder, sparse regularization is introduced to obtain each hidden unit. The average activation value; Specifically, the average activation value is expressed as: ; In the formula, It is the total number of samples. It is the first Hidden units of each sample activation value, Hidden units The average activation value.

[0052] B2: Add KL (Kullback-Leibler) divergence constraints and set the loss function of the encoder compression network so that the average activation value is close to the sparse target value, and obtain the set deep sparse autoencoder. Specifically, we can approximate this by adding a constraint, the goal of which is to make Approaching a small sparse target value ,in It is a sparsity parameter, usually a small value close to 0 (e.g., ...). KL divergence constraint is used. : ;

[0053] in, It is the number of neurons. .

[0054] In order to Approaching a small sparse target value The loss function of the compressed network is expressed as: ;

[0055] in, It is the loss function of the compressed network; It is the reconstruction error loss function of the compressed network; It is the sparsity constraint strength; It is a weight decay coefficient, used to prevent overfitting; It refers to the number of network layers; For the first Layer weight matrix The square of the Frobenius norm.

[0056] It should be noted that, due to the different dimensions of the fixed items in different fixed value sheets, some fixed items in the fixed value sheets may be 0, resulting in strong sparsity. This invention replaces the deep autoencoder in SOM-DAGMM with a deep sparse encoder. The deep sparse encoder makes the encoding representation sparse, thereby enhancing the selectivity for a small number of key features and reducing the clustering confusion of the subsequent GMM, so as to obtain a more stable energy score in scenarios with extremely few samples.

[0057] Sparse autoencoders are derived from traditional autoencoders by adding sparsity constraints. This sparsity applies to the hidden neurons of the autoencoder. By suppressing most of the outputs of these hidden neurons, the network achieves a sparse effect, reducing the influence of redundant features, such as features with a fixed value of 0. Sparsity can be simply explained as follows: if a neuron is considered activated when its output is close to 1, and suppressed when its output is close to 0, then the constraint that ensures the neuron is suppressed most of the time is called a sparsity constraint. Here, we assume the neuron's activation function is the sigmoid function. If tanh is used as the activation function, a neuron is considered suppressed when its output is -1.

[0058] Therefore, the deep sparse autoencoder can capture the sparsity features in the fixed-value data by adding sparsity constraints to the original deep autoencoder through steps B1-B2.

[0059] B3: Input the first fixed-value dataset into the configured deep sparse autoencoder to obtain compressed features. ; Specifically, the first fixed-value dataset is used as the input sample. Mapping to a low-dimensional latent space yields compressed features. Represented as: ;

[0060] in, It is the original vector of the first fixed-value dataset; yes The dimension; It is a compressed low-dimensional representation The vector dimension is much smaller than Generally, it's 1 to 3; It is the set of real numbers; Typically, it is a multi-layer feedforward neural network with the following structure: ; in, It is the set of parameters for the encoder, including the weight matrices of all layers. and bias vector ; It represents the number of layers in the feedforward neural network; It is an activation function, usually used .

[0061] B4: The compressed features are processed by the decoder to obtain the reconstructed vector and reconstruction error. ; Specifically, from the perspective of compression features Reconstruct the original vector to obtain the reconstructed vector. : ;

[0062] in, It is a decoder The set of parameters; decoder It is the inverse process of the encoder, and its purpose is to reconstruct the data from the low-dimensional representation so that the reconstructed vector is as close as possible to the original vector.

[0063] Reconstruction error By calculating the original vector With reconstructed vector The difference between them (such as the Euclidean distance) is obtained and used as the first anomaly indicator, represented as: ;

[0064] B5: Combining compressed features with reconstruction errors to generate the first joint feature vector. .

[0065] Specifically, the first joint feature vector .

[0066] It should be noted that the first joint eigenvector The first part consists of compression features from the encoder. This is a highly condensed low-dimensional feature extracted from the original high-dimensional fixed-value data by the encoder of the compression network; it represents the core features of the corresponding fixed-value data. The second part is the reconstruction error. A normal setpoint can be accurately reconstructed by the network, therefore Smaller. Conversely, an abnormal setpoint is difficult to reconstruct, leading to... Significantly increased.

[0067] S500: Combine the first joint feature vector with the topological feature vector of the network protection setting to generate the second joint feature vector. Input the second joint feature vector into the estimation network of the model and output the posterior probability of the sample belonging to each Gaussian component. In this embodiment of the application, in step S500, a second joint feature vector is generated by combining the first joint feature vector with the topological feature vector of the network protection setting. The second joint feature vector is then input into the estimation network of the model, and the posterior probability of the sample belonging to each Gaussian component is output. This includes the following steps C1-C3: C1: The first joint feature vector Topological feature vectors related to network protection settings By combining them, we obtain the second joint feature vector. ; Specifically, the features extracted in the previous steps spliced ​​together The second joint eigenvector is obtained from the above. As input to the estimation network.

[0068] C2: The second joint feature vector The input is fed into a multilayer perceptron (MLP) and connected. The function outputs the estimated posterior probability that the corresponding fixed data belongs to each Gaussian component. ; Specifically, the estimation network in DAGMM outputs a K-dimensional posterior probability by passing the low-dimensional joint features of each sample through a multi-layer neural network. .

[0069] It should be noted that the estimation network consists of a multi-layer MLP, responsible for learning the posterior probability of a sample belonging to each Gaussian component. First, features are concatenated and then input into the multi-layer MLP of the estimation network. The output is the posterior probability of a sample belonging to each Gaussian component, and then end-to-end optimization is performed based on this posterior probability. The estimation network part is equivalent to a Gaussian Mixture Model (GMM), used to simulate the results of a GMM.

[0070] C3: Based on posterior probability Calculate and update the parameters of the estimated network part in DAGMM.

[0071] Specifically, it can be done through The membership degree of a sample belonging to a single Gaussian distribution is obtained in place of the E-step of the EM algorithm in the GMM, and is used to update the GMM. , , The three parameters, through continuous iteration, allow the low-dimensional joint features of the samples to be well fitted by a mixture Gaussian distribution, which can be expressed as: ; ; ;

[0072] in, It is the first The mixing coefficient of a Gaussian distribution represents the weight of the distribution in the whole; and They are the first The mean and variance parameters of a Gaussian distribution; It is the first Joint characteristics of a single set of data; This represents the total number of samples. It is the first The data in the fixed value sheet belongs to the first... The posterior probability of a Gaussian distribution; S600: Construct a comprehensive loss function, and jointly optimize the deep sparse autoencoder and estimate network parameters based on the posterior probability through backpropagation until the model converges; In this embodiment of the application, the comprehensive loss function is constructed in S600, including: the loss function of the compressed network, the energy function of the Gaussian mixture model, and the power logic constraint loss; The loss function of the compressed network includes the reconstruction error loss function, the KL divergence constraint function, and L2 regularization. Specifically, the loss function of the compressed network is shown in step B2.

[0073] Among them, the energy function of the Gaussian mixture model The parameters of the Gaussian mixture model are calculated from the parameters of the estimated network model, including the first parameter. The mixing coefficient of the individual Gaussian distribution, the first The mean and variance parameters of the individual Gaussian distribution; Specifically, energy function Represented as: ;

[0074] in, For the first Joint latent representation of samples.

[0075] It should be noted that the degree of anomalousness of subsequent samples is defined by their negative log-likelihood (i.e., the energy function); the higher the energy value, the lower the probability that the corresponding fixed-value data belongs to the training data (normal samples) distribution, and therefore the more likely it is to be an outlier. Through experiments, a threshold can be selected, for example, the top 5% with high energy values ​​can be judged as anomalous samples.

[0076] Among them, the power logic constraint loss is determined by setting several protection setting verification logic constraint functions. And combined with the differentiable penalty function, we obtain the following: In this embodiment of the application, the power logic constraint loss described in S600 is achieved by setting a logic constraint function for verifying several protection settings. And combined with a differentiable penalty function, it is obtained, including: The primary and backup order constraints, upper and lower limit constraints, and directional constraints are set through logical natural language, and the degree of violation of each constraint is set through mathematical form; Exemplary, mathematical As a measure of the degree of violation. Let the feature vector of a single sample be... Construct several logical constraint functions ,in For the first The degree of violation of the logical constraints, if A value of 0 indicates that the constraint is fully satisfied, while a larger value indicates a more severe violation. The specific constraint rules are as follows: Primary / Secondary Sequence Constraints The main protection should operate first near the fault; the backup protection should operate later if the main protection has not yet operated. This is often manifested in the main protection's operating current threshold being higher than the backup protection's sensitivity threshold, meaning the main protection parameters are more sensitive than the backup protection parameters. When P is the main protection parameter and B is the backup protection parameter, for the current parameters: For the time parameter, In the formula, The operating current value of the main protection. This is the operating current value of the backup protection. The duration of the primary protective action, The action time for backup protection.

[0077] Upper and lower limit constraints The protection parameters must be within the acceptable engineering range. The current formula is as follows: ;

[0078] In the formula, Minimum current; This is the maximum current value. To obtain the current value in real time.

[0079] Directional constraints Directional protection should not activate in prohibited directions. This can be achieved through angle difference or distinguishing markers. The direction detection quantity for protection is the phase angle. At that time, the allowed range of action directions is The formula for determining the degree of violation is: .

[0080] In the formula, For the minimum phase angle, For the maximum phase angle, Phase angle is acquired in real time.

[0081] Furthermore, the differentiable penalty function is designed to facilitate deep network training, and the differentiability of the softplus function can help the model perform end-to-end joint optimization. This can be represented using the softplus function as: ;

[0082] in, It is the number of constraint rules; for each class coefficient Based on expert experience, the constraint rules can be set in order of importance and dynamically adjusted according to the convergence during training. The coefficients can be set according to experience. For example, if the primary and backup order constraint is more important, then its corresponding coefficient will be larger, usually 0~1. For the first The degree of violation of the logical constraints, As a regularization term, it is added to the total loss function to guide the model to learn a representation that simultaneously satisfies data reconstruction and physical logic.

[0083] In summary, the comprehensive loss function The formula can be expressed as: ;

[0084] In the formula, denoted as the number of samples; the first three terms are the loss functions of the compressed network, the fourth and fifth terms are the energy loss functions of the Gaussian mixture model, and the sixth term is the power logic constraint loss function.

[0085] It should be noted that this comprehensive loss function simultaneously considers feature compression quality, sparse representation capability, parameter regularization, and power logic safety constraints; it is a differentiable objective function that updates all parameters jointly through backpropagation (BP) and stochastic gradient descent (SGD / Adam). All loss functions are differentiable (reconstruction error, KL divergence, L2 regularization, and logic constraints are all differentiable), thus allowing completion in a single backpropagation. Constraint gradients drive the latent representation and output results to fall within a reasonable power protection setting range, preventing the model from relying solely on statistical features. SOM, on the other hand, is trained independently and does not participate in joint optimization.

[0086] In this embodiment of the application, S600 involves jointly optimizing the deep sparse autoencoder and estimating network parameters through backpropagation, including: Solve for the gradient of the comprehensive loss function; Gradients are naturally assigned to the deep sparse autoencoder and the estimation network; After multiple iterations, the deep sparse autoencoder is updated using Adam, and all parameters in the network are estimated until the network loss converges.

[0087] For example, after multiple iterations and updates to the network parameters until the network loss converges, the visualization results are as follows: Figures 2-5 As shown. Among them, Figure 2 For total losses, Figure 3 To reconstruct losses, Figure 4 For logical constraint loss, Figure 5 As shown in the overall curve visualization, the three loss functions and the total loss value of the model show a good trend of stable decrease and gradual convergence as the number of training iterations increases. This indicates that the joint optimization process is effective, and the parameter update strategy of the deep sparse autoencoder and the estimation network successfully reduces the overall objective function. The training process is stable and there is no obvious overfitting or oscillation.

[0088] S700: Based on the optimized model, forward computation is performed on the first fixed-value input dataset to obtain the loss function of reconstruction error, energy score and logical violation degree; S800: Based on the loss function of reconstruction error, energy score and logic violation degree, set the comprehensive anomaly score and anomaly judgment threshold; Specifically, the S700-S800 converts the model's reconstructed output, energy loss, and logic violation level into intuitive anomaly scores and type labels.

[0089] For example, the trained model weights are first saved, and then the weights are loaded to perform anomaly detection on the test set; the test set contains 43 samples, of which 6 are injected with known anomalies.

[0090] Anomalies are handled using two methods: parameter offset anomalies and logic relationship disruption anomalies. Parameter offset anomalies refer to randomly selecting a specific proportion of samples from the test set and shifting one or more setpoint parameters by a certain degree, such as increasing or decreasing by 1-2 standard deviations. Logic relationship disruption anomalies do not require changing the absolute value of a single parameter, but rather create anomalies by adjusting the relative relationships between parameters, such as making the current setting of the upstream protection less than that of the downstream protection.

[0091] The abnormal score is calculated using a comprehensive formula: 0.3 × Normalized reconstruction error + 0.4 × Normalized energy loss + 0.3 × Normalized logic violation degree All three passed. The function is used to ensure that the final score is between 0 and 1.

[0092] Overall score formula as follows: ;

[0093] For each test sample, the reconstructed output, energy loss, and logic violation degree are obtained through model forward propagation. The reconstruction error is calculated as the error between the original input and the reconstructed output. The energy loss is calculated based on the negative log-likelihood of the sample using the Gaussian mixture model parameters learned during training. The logic violation degree is calculated using the electric constraint function defined in the model and compressed to the 0-1 range using the Sigmoid function. The overall anomaly score is obtained by weighted summation of the three indicators, with weights of 0.3, 0.4, and 0.3, respectively. This overall score reflects the overall anomaly degree of each sample; a higher score indicates a greater probability of anomaly. By analyzing the score distribution of 43 samples, anomalous samples can be identified and compared with 6 known anomalous samples to evaluate the model's detection performance. Finally, the model outputs a detailed overall score for each test sample.

[0094] like Figure 6 As shown, by setting an appropriate threshold (e.g., 0.8), samples can be classified as normal or abnormal, and performance metrics such as accuracy, recall, and F1 score can be calculated to comprehensively evaluate the model's effectiveness in power system setting verification tasks. If an instance is positive and is predicted as positive, it is a true negative (TP); if an instance is positive but is predicted as negative, it is a false negative (FN); if an instance is negative but is predicted as positive, it is a false positive (FP); if an instance is negative and is predicted as negative, it is a true negative (TN). Figure 6The sample size is 43, of which 5 are actually abnormal and 38 are actually normal.

[0095] Depend on Figure 7 and Figure 8 The results show that the model predicted 38 normal samples and 5 abnormal samples. Based on the labels of the detection results, TP is 37, TN is 4, FP is 1, and FN is 1. The accuracy, recall, precision, and F1 score are calculated to be 95.35%, 80%, and 80%, respectively.

[0096] Specifically, accuracy Represented as: ;

[0097] Recall rate Represented as: ;

[0098] Accuracy Represented as: ;

[0099] The F1 score is expressed as: ;

[0100] S900: Input the setpoint data to be verified into the optimized model, calculate the comprehensive anomaly score, and determine the status and anomaly type by combining the anomaly judgment threshold.

[0101] Specifically, if the overall score is below the threshold, it is judged as normal; if it is above the threshold, it is judged as abnormal, and the type of abnormality (data abnormality, logic abnormality or compound abnormality) can be further determined based on the scores of each sub-item, and the abnormal value position and abnormality type are output. Furthermore, the verification results are output in a visual format, including abnormal setpoints, abnormal types, specific violated logical rules, and correction suggestions, providing decision support for operations and maintenance personnel.

[0102] In summary, the improved SOM-DAGMM model can not only effectively identify abnormal setpoint values, but also detect logical conflicts and mismatches that are difficult to detect using traditional methods. The model exhibits stronger robustness and accuracy when handling high-dimensional, multi-feature coupled setpoint data, significantly reducing false alarm and missed alarm rates, while also possessing good interpretability and applicability to complex power grid environments with different voltage levels and equipment types. Future development could further incorporate time-series dynamic modeling and online learning mechanisms to enhance adaptability to setpoint drift and changes in operating modes, providing comprehensive support for intelligent operation and refined management of grid protection systems.

[0103] Example 3 illustrates a schematic scheme for a network connection anomaly detection method based on an improved SOM-DAGMM. It should be noted that the technical solution of this network connection anomaly detection system based on an improved SOM-DAGMM is based on the same concept as the technical solution of the network connection anomaly detection method based on an improved SOM-DAGMM described above. Details not described in detail in the technical solution of the network connection anomaly detection system based on an improved SOM-DAGMM in this example can be found in the description of the technical solution of the network connection anomaly detection method based on an improved SOM-DAGMM described above.

[0104] This embodiment also provides another network-related setpoint anomaly detection system based on an improved SOM-DAGMM, including: The acquisition module is used to acquire historical network protection setting data within the region; The preprocessing module is used to extract feature parameters from the fixed-value data, perform data preprocessing, and obtain the first fixed-value dataset. The first feature extraction module is used to construct the SOM-DAGMM model. It uses the self-organizing mapping algorithm and the first fixed value dataset as training samples to construct a topology mapping model and extract the topology feature vector of the network protection fixed value. The second feature extraction module is used to input the first fixed-value dataset into the deep sparse autoencoder in the model and obtain the first joint feature vector through the decoder. The joint input-output module is used to combine the first joint feature vector with the topological feature vector of the network protection setting to generate a second joint feature vector, input the second joint feature vector into the estimation network of the model, and output the posterior probability of the sample belonging to each Gaussian component. The update module is used to construct the comprehensive loss function, which jointly optimizes the deep sparse autoencoder and estimates the network parameters based on the posterior probability through backpropagation until the model converges. The first calculation module is used to perform forward calculations on the first fixed-value dataset based on the optimized model to obtain a loss function that includes reconstruction error, energy score, and degree of logical violation. The second calculation module is used to set the comprehensive anomaly score and anomaly judgment threshold based on the loss function of reconstruction error, energy score and logical violation degree; The judgment module is used to input the setpoint data to be verified into the optimized model, calculate the comprehensive anomaly score, and determine the status and anomaly type by combining the anomaly judgment threshold.

[0105] This embodiment also provides a computer device applicable to a network-related value anomaly detection method based on an improved SOM-DAGMM, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the network-related value anomaly detection method based on an improved SOM-DAGMM as proposed in the above embodiment.

[0106] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements a network-related value anomaly detection method based on an improved SOM-DAGMM, as proposed in the above embodiments.

[0107] The storage medium proposed in this embodiment and the implementation of a network-related value anomaly detection method based on an improved SOM-DAGMM proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0108] Based on the above description of the implementation methods, those skilled in the art will clearly understand that the present invention can be implemented using software and necessary general-purpose hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0109] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for detecting network-related setpoint anomalies based on an improved SOM-DAGMM, characterized in that, include: Obtain historical network protection setting data within the region; Extract the feature parameters from the fixed-value data, perform data preprocessing, and obtain the first fixed-value dataset; Construct a SOM-DAGMM model; using the self-organizing map algorithm and the first set of fixed values ​​as training samples, construct a topology mapping model and extract the topology feature vectors of the network protection set values; The first fixed-value dataset is input into the deep sparse autoencoder in the model, and the first joint feature vector is obtained through the decoder. By combining the first joint feature vector with the topological feature vector of the network protection setting, a second joint feature vector is generated. The second joint feature vector is then input into the estimation network of the model, and the posterior probability of the sample belonging to each Gaussian component is output. Construct a comprehensive loss function, and jointly optimize the deep sparse autoencoder and estimate network parameters based on the posterior probability through backpropagation until the model converges. Based on the optimized model, forward computation is performed on the first fixed-value input dataset to obtain the loss function of reconstruction error, energy score and logical violation degree; Based on the loss function of reconstruction error, energy score and logical violation degree, a comprehensive anomaly score and anomaly judgment threshold are set; Input the data to be verified into the optimized model, calculate the comprehensive anomaly score, and combine it with the anomaly judgment threshold to determine the status and anomaly type.

2. The method for detecting network-related anomalies based on an improved SOM-DAGMM as described in claim 1, characterized in that, Using a self-organizing mapping algorithm and the first setpoint dataset as training samples, a topology mapping model is constructed to extract the topology feature vectors of the network protection setpoints, including: Based on the first set value dataset and the network protection set value dimension, a protection set value feature space of the network protection system is constructed. Define a Each grid node of the two-dimensional grid Each has a feature related to the input. Weight vectors of the same dimension ; Calculate the feature vector of each input in the first fixed-value dataset. The Euclidean distance between the unit and the weight vectors of all nodes is used to find the best matching unit. Update and iterate the weights of all nodes until the topology mapping model converges; For each sample in the first fixed-value dataset, the coordinates of the corresponding best-matching unit in the grid are obtained. Calculate the Euclidean distance from each sample to the corresponding best-matching unit. and to the corresponding The average distance of the nearest best-matching units together constitutes the topological feature vector of the network protection setting. .

3. The method for detecting network-related anomalies based on an improved SOM-DAGMM as described in claim 2, characterized in that, The first fixed-value dataset is input into the deep sparse autoencoder in the model, and the first joint feature vector is obtained through the decoder, including: Based on a deep autoencoder, sparse regularization is introduced to obtain each hidden unit. The average activation value; By adding KL divergence constraints and setting the loss function of the encoder compression network, a fully defined deep sparse autoencoder is obtained. The first fixed-value dataset is input into the configured deep sparse autoencoder to obtain compressed features. ; The compressed features are processed by a decoder to obtain the reconstructed vector and reconstruction error. ; The first joint feature vector is generated by combining the compressed features and the reconstruction error. .

4. The method for detecting network-related anomalies based on an improved SOM-DAGMM as described in claim 3, characterized in that, By combining the first joint feature vector with the topological feature vector of the network protection setting, a second joint feature vector is generated. This second joint feature vector is then input into the model's estimation network, outputting the posterior probability of a sample belonging to each Gaussian component, including: The first joint feature vector Topological feature vectors related to network protection settings By combining them, we obtain the second joint feature vector. ; The second joint feature vector Input to a multi-layer MLP, connection The function outputs the estimated posterior probability that the corresponding fixed data belongs to each Gaussian component. ; Based on posterior probability Calculate and update the parameters of the estimated network part in DAGMM.

5. The method for detecting network-related anomalies based on an improved SOM-DAGMM as described in claim 4, characterized in that, Construct a comprehensive loss function, including: the loss function of the compressed network, the energy function of the Gaussian mixture model, and the power logic constraint loss; The loss function of the compressed network includes the reconstruction error loss function, the KL divergence constraint function, and L2 regularization. The energy function of the Gaussian mixture model is calculated from the parameters of the estimated network model. The parameters of the Gaussian mixture model include the first... The mixing coefficient of the individual Gaussian distribution, the first The mean and variance parameters of the individual Gaussian distribution; Among them, the power logic constraint loss is determined by setting several protection setting verification logic constraint functions. And obtained by combining a differentiable penalty function.

6. The method for detecting network-related anomalies based on an improved SOM-DAGMM as described in claim 5, characterized in that, The power logic constraint loss is determined by setting several protection setting verification logic constraint functions. And combined with a differentiable penalty function, it is obtained, including: The primary and backup order constraints, upper and lower limit constraints, and directional constraints are set through logical natural language, and the degree of violation of each constraint is set through mathematical form; pass The function is represented as: ； in, It is the number of constraint rules; for each class coefficient Based on expert experience; For the first The degree of violation of the logical constraints, It is added as a regularization term to the total loss function.

7. The method for detecting network-related anomalies based on an improved SOM-DAGMM as described in claim 6, characterized in that, The deep sparse autoencoder and estimated network parameters are jointly optimized through backpropagation, including: Solve for the gradient of the comprehensive loss function; Gradients are naturally assigned to the deep sparse autoencoder and the estimation network; After multiple iterations, the deep sparse autoencoder is updated using Adam, and all parameters in the network are estimated until the network loss converges.

8. A network-related setpoint anomaly detection system based on an improved SOM-DAGMM, employing the method described in any one of claims 1-7, characterized in that, include: The acquisition module is used to acquire historical network protection setting data within the region; The preprocessing module is used to extract feature parameters from the fixed-value data, perform data preprocessing, and obtain the first fixed-value dataset. The first feature extraction module is used to construct the SOM-DAGMM model. It uses the self-organizing mapping algorithm and the first fixed value dataset as training samples to construct a topology mapping model and extract the topology feature vector of the network protection fixed value. The second feature extraction module is used to input the first fixed-value dataset into the deep sparse autoencoder in the model and obtain the first joint feature vector through the decoder. The joint input-output module is used to combine the first joint feature vector with the topological feature vector of the network protection setting to generate a second joint feature vector, input the second joint feature vector into the estimation network of the model, and output the posterior probability of the sample belonging to each Gaussian component. The update module is used to construct the comprehensive loss function, which jointly optimizes the deep sparse autoencoder and estimates the network parameters based on the posterior probability through backpropagation until the model converges. The first calculation module is used to perform forward calculations on the first fixed-value dataset based on the optimized model to obtain a loss function that includes reconstruction error, energy score, and degree of logical violation. The second calculation module is used to set the comprehensive anomaly score and anomaly judgment threshold based on the loss function of reconstruction error, energy score and logical violation degree; The judgment module is used to input the setpoint data to be verified into the optimized model, calculate the comprehensive anomaly score, and determine the status and anomaly type by combining the anomaly judgment threshold.

9. A computer device, characterized in that, include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the network-related value anomaly detection method based on the improved SOM-DAGMM as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores computer-executable instructions, which, when executed by a processor, implement the steps of the network-related value anomaly detection method based on an improved SOM-DAGMM as described in any one of claims 1 to 7.

Images