XGBoost-based self-training semi-supervised electricity larceny detection method

Abstract

The invention discloses a self-training semi-supervised electricity larceny detection method based on XGBoost, and the method specifically comprises the following steps: collecting original power utilization data of a user, carrying out the preprocessing, and constructing a power utilization load time sequence of the user; carrying out abnormal feature extraction based on a TSFresh time sequence feature extraction framework, and screening important features through a random forest and a Pearson correlation coefficient; randomly selecting a certain proportion of feature samples to construct an electricity stealing sample through an electricity stealing attack function, balancing positive and negative samples by adopting a Borderline-SMOTE method, and randomly sampling a larger proportion of label-free data to train an STXGB detection model; and inputting online data into the STXGB detection model after the online data is subjected to the feature engineering, outputting suspicious users, and expanding labeled samples in combination with a field check result so as to realize retraining and closed loop updating of the model. According to the invention, the efficiency of electricity stealing detection can be improved by combining a self-training semi-supervised mechanism and a dual verification mechanism for predicting confidence and similarity between samples.

Description

Technical Field

[0001] This invention relates to the field of smart grid industry technology, especially the application of artificial intelligence technology in large-scale power grid security, defense systems and intelligent dispatching, and in particular, to a self-trained semi-supervised electricity theft detection method based on XGBoost. Background Technology

[0002] In the daily operation and maintenance of large-scale power grid transmission and distribution, electricity theft not only causes economic losses to distribution companies, but may also damage the stability and security of power grid operation. Therefore, electricity theft detection is an important research direction in the field of power transmission and distribution management.

[0003] Traditional methods of detecting electricity theft primarily rely on power companies dispatching specialized technicians to manually inspect users' power lines and related equipment on-site. This involves manually checking circuit connections and equipment operating status to determine if theft is occurring. However, in practical applications, traditional methods have limitations. First, with the continuous expansion of the electricity user base, the proportion of users engaging in electricity theft is relatively low. Obtaining effective user tags requires significant human and material resources to screen a massive number of users individually, resulting in extremely high time and labor costs. Second, manual screening is inefficient, failing to achieve rapid and comprehensive coverage of a large number of users, and thus unable to promptly detect electricity theft, making it difficult to meet the needs of large-scale electricity consumption scenarios.

[0004] In recent years, with the development of smart grid technology, smart meters have become widely used at the user end. Smart meters can collect users' electricity load data in real time, forming continuous electricity consumption time series, making it easy to obtain a large amount of unlabeled user electricity load data. Currently, traditional electricity theft detection models are mostly based on supervised learning methods, and their performance depends on a large amount of labeled training data. As mentioned earlier, obtaining user labels for electricity theft is costly, resulting in insufficient training data for supervised models, which limits their detection accuracy and generalization ability. Therefore, how to utilize the large amount of unlabeled electricity load data collected by smart meters to improve the performance of traditional supervised electricity theft detection models has become an important problem faced in electricity theft detection in actual production scenarios.

[0005] In summary, to address the limitations of traditional manual methods and the challenge of utilizing the large amount of untagged electricity load data collected by smart meters to improve the performance of traditional supervised electricity theft detection models, a self-trained semi-supervised electricity theft detection method based on XGBoost is proposed. Summary of the Invention

[0006] The main objective of this invention is to provide a self-trained semi-supervised electricity theft detection method based on XGBoost. It employs the TSFresh time-series feature extraction framework to automatically construct a feature set from electricity consumption time series data, and combines it with XGBoost to build a self-learning semi-supervised model, STXGB. This model securely utilizes unlabeled data to improve model performance by combining a dual verification mechanism of prediction confidence and sample similarity. This addresses the shortcomings of existing supervised detection models, such as reliance on large amounts of labeled data, high cost of obtaining labels for electricity theft users, and failure to effectively utilize unlabeled electricity load data collected by smart meters, resulting in limited detection accuracy and generalization ability. It also addresses the limitations of traditional manual screening, which is insufficient to meet the detection needs of large-scale electricity consumption scenarios.

[0007] Based on the first main aspect of the present invention, a self-trained semi-supervised electricity theft detection method based on XGBoost is provided. This method trains and applies an electricity theft detection model based on the user's original electricity consumption dataset, and combines XGBoost to construct a self-learning semi-supervised detection model STXGB.

[0008] The method includes the following steps:

[0009] The user's raw electricity consumption data is collected and preprocessed to construct the user's electricity load time series; the preprocessing includes time seriesification, dirty data processing and missing value processing.

[0010] Anomaly feature processing is performed based on TSFresh time series features, and new features are generated using feature functions; the feature functions include basic statistical functions, distribution feature functions, trend feature functions, fast Fourier functions, and autocorrelation feature functions;

[0011] Based on the new features, random forest is used to evaluate the importance of features, and Pearson correlation coefficient is used to analyze feature correlation and remove redundant features; the new features include mean, median, standard deviation, skewness and kurtosis;

[0012] The new features after removing redundant features are randomly selected and passed through the electricity theft attack function to generate electricity theft samples. The Borderline-SMOTE method is used to balance positive and negative samples, and combined with a larger proportion of unlabeled data, the STXGB detection model is trained.

[0013] After the online data undergoes preprocessing and anomaly feature processing and feature selection, it is input into the STXGB detection model, which outputs suspicious users.

[0014] As a further preferred embodiment, in the aforementioned method, the preprocessing step includes:

[0015] The user's daily electricity load data is time-series processed, and the data from each sampling point are grouped according to the metering point number and sorted within the group according to the time sequence. Each group contains the electricity consumption time series of a user within one cycle.

[0016] Because the measurement data contains dirty data and null values, that is, all sampling points are zero, the dirty data is deleted through the dirty data processing.

[0017] The missing value processing uses the Grange interpolation method to fill in the missing values;

[0018] Specifically, five data points before and after the missing value are extracted, and the extracted ten data points are grouped together to generate the missing value based on the Lagrange difference formula;

[0019] The formula for the Grange difference:

[0020]

[0021] Where, in the formula Representing the One data point; Represents sample values; It is a Lagrange polynomial.

[0022] As a further preferred embodiment, in the aforementioned method, the ratio of randomly selecting samples after preprocessing and abnormal feature processing is a preset fixed ratio.

[0023] The sampling ratio of the unlabeled data is greater than the grouping ratio of the samples after preprocessing and anomaly feature processing;

[0024] The balanced samples and the unlabeled data together constitute the complete training dataset of the STXGB detection model.

[0025] As a further preferred embodiment, in the aforementioned method, the execution steps for training the STXGB detection model specifically include:

[0026] Input labeled and unlabeled datasets, set hyperparameters, and train the base model using the labeled dataset; the hyperparameters include the number of iterations, the number of nearest neighbors, and the confidence threshold.

[0027] Based on the basic model, pseudo-labels and predicted electricity theft probabilities are obtained from the unlabeled dataset. Samples whose predicted electricity theft probabilities do not drop the threshold are selected to form a pseudo-labeled dataset to be confirmed.

[0028] Calculate the cosine similarity between the pseudo-labeled dataset and the labeled dataset, select the 5 samples with the highest similarity in the labeled dataset for majority voting, and generate secondary pseudo-labels;

[0029] Samples whose pseudo-labels are equal to the secondary pseudo-labels are selected and expanded into the labeled dataset, while those in the unlabeled dataset are removed.

[0030] The base model is retrained based on the expanded labeled data, and the above steps are repeated until the iteration termination condition is met.

[0031] As a further preferred embodiment, in the aforementioned method, the iteration termination condition includes:

[0032] The iteration count reaches 100 or the remaining proportion of unlabeled data is less than 2.5%;

[0033] The remaining proportion is 1 / 40 of the initial labeled data size.

[0034] As a further preferred embodiment, in the aforementioned method, the step of generating electricity theft samples includes:

[0035] Randomly select the electricity consumption time series of a normal user from the preprocessed and abnormal feature-processed samples, and randomly sample 10% of the data from it as the basis for sample generation;

[0036] Based on four preset electricity theft functions, the randomly sampled data is modified to generate four labeled datasets for electricity theft modes, and a mixed labeled dataset containing the four electricity theft modes is also generated.

[0037] As a further preferred embodiment, in the aforementioned method, the step of outputting suspicious users includes:

[0038] Technical personnel were dispatched to conduct on-site verification of the electricity usage of the suspected users. If the verification confirmed that a user was stealing electricity, their corresponding load data was marked with an electricity theft label. If the verification showed that a user was not stealing electricity, their corresponding data was marked with a normal label.

[0039] The data from the electricity theft tags and normal tags are expanded into the tag dataset, and the STXGB detection model is retrained and evaluated based on the expanded tag dataset.

[0040] Based on the second main aspect of the present invention, a training method for a self-learning semi-supervised detection model STXGB is provided, comprising the following steps:

[0041] The user's original electricity consumption dataset is obtained as a training sample, and the training sample is input into a general module for processing. The general module includes data preprocessing and anomaly feature processing based on TSFresh time series features, and redundant features are removed by evaluating feature importance through random forest and combining Pearson correlation coefficient.

[0042] Randomly select a portion of the samples processed by the general module, and generate electricity theft samples based on the electricity theft attack function;

[0043] The Borderline-SMOTE method is used to balance positive and negative samples to obtain a balanced sample set, while a larger proportion of unlabeled data is randomly sampled.

[0044] The balanced sample set and the unlabeled data are input into the STXGB detection model to train the STXGB detection model.

[0045] Based on a third key aspect of the present invention, an electronic device is provided, comprising: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0046] The memory stores a computer program, which, when executed by the processor, causes the processor to perform the aforementioned self-trained semi-supervised electricity theft detection method based on XGBoost.

[0047] Based on a fourth key aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed, implements the aforementioned self-trained semi-supervised electricity theft detection method based on XGBoost.

[0048] Compared with existing technologies, this invention provides a self-trained semi-supervised electricity theft detection method based on XGBoost. First, this invention constructs a standardized general data processing method, combines TSFresh time series features for anomaly feature processing with a dual feature selection mechanism of random forest and Pearson correlation coefficient, and achieves efficient and standardized processing of massive electricity consumption data collected by smart meters. This solves the problems of low efficiency and large errors caused by the lack of standard data processing and reliance on human experience in traditional manual screening from the source.

[0049] Secondly, the STXGB detection model designed in this invention generates diverse electricity theft samples through four electricity theft functions. With the help of an iterative optimization mechanism of pseudo-label generation, cosine similarity and dual-label consistency screening, it makes full use of a large amount of unlabeled electricity load data, improves the ability to identify highly concealed electricity theft behavior, and takes into account the coverage of different electricity theft modes. Its generalization ability is better than that of traditional supervised models.

[0050] Finally, this invention constructs a closed-loop detection system that includes model training, on-site verification, sample expansion, and iterative optimization, enabling dynamic updates of the detection model. By cyclically supplementing the labeled data through on-site verification, the overall cost of tag acquisition is further reduced. While improving the accuracy and efficiency of electricity theft identification, it also reduces the operation and maintenance costs of power distribution companies, providing a feasible solution for electricity theft detection in large-scale electricity consumption scenarios. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0052] Figure 1 The following is a flowchart illustrating the execution of a self-trained semi-supervised electricity theft detection method based on XGBoost in one embodiment of the present invention.

[0053] Figure 2 The diagram illustrates a system architecture of a self-trained semi-supervised electricity theft detection method based on XGBoost, according to one embodiment of the present invention.

[0054] Figure 3 The diagram shows the original load curve and a comparison of the load curves under four different electricity theft modes for a self-trained semi-supervised electricity theft detection method based on XGBoost in one embodiment of the present invention.

[0055] Figure 4 This diagram illustrates a comparison of the accuracy of a self-trained semi-supervised electricity theft detection method based on XGBoost and nine other models on the SGCC dataset in one embodiment of the present invention.

[0056] Figure 5 The diagram shows a comparison of the ROC curves of a self-trained semi-supervised electricity theft detection method based on XGBoost and nine other models in one embodiment of the present invention. Detailed Implementation

[0057] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the present invention. It should be understood that the following embodiments are not intended to limit the scope of the present invention, but are merely illustrative of the essential spirit of the technical solution of the present invention.

[0058] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0059] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0060] The following is a description of the specific meanings of technical terms, English abbreviations, and formula parameters that may be used in this invention:

[0061] TSFresh: Time Series Fresh, a framework for feature extraction from time series data.

[0062] XGBoost: eXtreme Gradient Boosting is an efficient ensemble learning algorithm that constructs multiple decision trees and iteratively optimizes them through a gradient boosting strategy. It has advantages such as regularization and parallel computing.

[0063] STXGB: A semi-supervised learning model based on XGBoost.

[0064] Borderline-SMOTE (Borderline Synthetic Minority Oversampling Technique) is an improved version of the SMOTE algorithm. It generates synthetic samples by oversampling samples close to the decision boundary in the minority class.

[0065] Random Forest: A machine learning algorithm based on the idea of ​​ensemble learning, which achieves prediction by constructing multiple decision trees and integrating the decision results.

[0066] Pearson correlation coefficient: This is a statistic that measures the degree of linear correlation between two continuous variables. It is essentially calculated by dividing the product of the covariance between the variables by their respective standard deviations. Its value ranges from [value missing in original text]. 1 indicates a perfect positive correlation, -1 indicates a perfect negative correlation, and 0 indicates no linear correlation.

[0067] like Figure 1 As shown, in one embodiment, the present invention provides a self-trained semi-supervised electricity theft detection method based on XGBoost, comprising the following steps S1-S5:

[0068] S1. Collect the user's original electricity consumption data and preprocess it to construct the user's electricity load time series; the preprocessing includes time seriesification, dirty data processing and missing value processing.

[0069] S2, anomaly feature processing is performed based on TSFresh time series features, and new features are generated using feature functions; the feature functions include basic statistical functions, distribution feature functions, trend feature functions, fast Fourier functions, and autocorrelation feature functions;

[0070] S3, based on the new features, random forest is used to evaluate the importance of the features, and the Pearson correlation coefficient is used to perform feature correlation analysis to remove redundant features; the new features include mean, median, standard deviation, skewness and kurtosis;

[0071] S4. Randomly select samples that have undergone the preprocessing and abnormal feature processing and generate electricity theft samples through the electricity theft attack function. Use the Borderline-SMOTE method to balance positive and negative samples and combine a larger proportion of unlabeled data to train the STXGB detection model.

[0072] S5. After the online data has undergone the preprocessing and anomaly feature processing and feature selection, it is input into the STXGB detection model and outputs suspicious users.

[0073] In one feasible implementation, the electricity theft detection process is described as follows:

[0074] In this embodiment, combined with Figure 2 As shown, the electricity theft detection process mainly describes the training and application of an electricity theft detection model based on users' original electricity consumption datasets. The main components and application process of the electricity theft detection framework are as follows:

[0075] General modules:

[0076] The general modules include data preprocessing and anomaly feature extraction based on the TSFresh time series feature extraction framework.

[0077] Data preprocessing includes time serialization, dirty data processing, and missing value processing to construct the user's electricity load time series.

[0078] The anomaly feature extraction module provides a large number of feature functions, including basic statistics functions, features of the distribution functions, trend function, fast Fourier transform (FFT) function, autocorrelation function, etc. These feature functions can generate a large number of new features such as mean, median, standard deviation, skewness and kurtosis.

[0079] The feature selection module uses random forest to evaluate feature importance and Pearson correlation coefficient to perform feature correlation analysis in order to remove redundant features and reduce computational complexity.

[0080] Specifically, the data source of this invention is the normal electricity consumption records of 20,000 ordinary industrial users of a provincial power grid in November 2021. Each user has one electricity consumption record per day, corresponding to the user's daily electricity consumption, totaling 900,000 data records.

[0081] The specific data structure of the daily electricity consumption record is shown in Table 1. The metering point number represents the number of the electricity metering device, which can be linked to the user's detailed information. The positive active power total represents the user's daily electricity consumption.

[0082] In this embodiment, three fields are required: metering point number, data time, and total positive active power, which are used to extract the user's electricity consumption time sequence.

[0083] Table 1 Original dataset structure

[0084]

[0085] In one embodiment, the data preprocessing work of the present invention includes time serialization, dirty data processing, and missing value imputation.

[0086] First, the daily electricity load data of users is time-series processed. The data from each sampling point is grouped according to the metering point number and then sorted within the group according to the time sequence. Each group is a time series of electricity consumption for a user within a certain period.

[0087] Secondly, due to reasons such as abnormal data collection or data reporting, there may be dirty data and null values ​​in the measurement data.

[0088] Users whose sampling points are all zero are of no value to this study and are therefore directly considered dirty data and deleted.

[0089] In addition, some users have missing electricity usage records at certain times. This paper uses the Lagrange interpolation method to supplement the missing values. Specifically, five data points before and after the missing value are taken, and ten data points are grouped together to generate the missing value according to the Lagrange difference formula.

[0090] The Lagrange interpolation formula is shown below.

[0091]

[0092] in, Representing the One data point; Represents sample values; It is a Lagrange polynomial.

[0093] Training phase:

[0094] First, the training samples are processed by a general module, and a certain proportion of the data is randomly selected to artificially generate electricity theft samples according to the electricity theft attack function.

[0095] Then, the Borderline-SMOTE method was used to balance the positive and negative samples in the labeled dataset, and a larger proportion of unlabeled data was randomly sampled to train the STXGB detection model.

[0096] Application phase:

[0097] This step outlines a method for enhancing the training of the detection model during the model application phase using data from on-site electricity usage verification.

[0098] During the application phase, the online data processed by the general module is input into the STXGB detection model, and the model outputs highly suspicious electricity theft users.

[0099] Then, technical personnel were dispatched to conduct on-site verification of these users' electricity usage.

[0100] Users confirmed to be stealing electricity will have their corresponding load data labeled with an electricity theft tag; for users who are falsely detected, their corresponding data will be labeled with a normal tag.

[0101] The labeled data was added to the label dataset to expand the original sample data, and the electricity theft detection model was retrained and evaluated.

[0102] In one embodiment, the construction of an electricity theft sample is described:

[0103] In this embodiment, let This represents the user's metering data for one month. Based on the daily electricity consumption data in this embodiment, four electricity theft attack functions were designed to modify the metering data and simulate different electricity theft patterns.

[0104] Type 1:

[0105]

[0106] Type 2:

[0107]

[0108] Type 3:

[0109]

[0110] Type 4:

[0111]

[0112] Type 1 means that all measurement readings are multiplied by the same random number. The value ranges from 0.2 to 0.8 and is used to simulate attacks that reduce electricity theft by the same proportion.

[0113] Type 2 means that each measurement time point is multiplied by a random number. , The changes over time are used to simulate attacks that randomly proportionally reduce electricity theft.

[0114] Type 3 indicates that when the meter reading is greater than At that time, the corresponding measurement data is set to , A random number between 0 and the maximum electricity consumption, used to simulate peak shaving and electricity theft attacks.

[0115] Type 4 indicates that the metering data in the time set T is 0, where T is 17 randomly generated metering time points within a month, used to simulate attacks that randomly set the data to zero to steal electricity.

[0116] By randomly selecting a normal user's electricity consumption time series and modifying the original data according to the attack function described above, a typical example of normal electricity consumption and four types of electricity theft attack behaviors can be generated, as shown in Figure 3.

[0117] It can be seen that due to the randomness of electricity consumption, the original load curve of users exhibits large fluctuations, and various attack methods are highly concealed. If the label is ignored, it is difficult to intuitively distinguish which curve is the original load curve.

[0118] It is evident that electricity theft datasets are characterized by high concealment and high randomness.

[0119] Based on four electricity theft modes, an electricity theft sample generation method was adopted. 10% of the data was randomly sampled from the normal electricity consumption dataset. According to the modification methods of four attack functions for the four types, a total of four labeled datasets, CT1, CT2, CT3 and CT4, and a mixed dataset CT5 containing the four electricity theft modes were generated.

[0120] In one feasible implementation, the STXGB electricity theft detection model is described and explained:

[0121] This invention designs a semi-supervised electricity theft detection model STXGB (Self-Trained XGBoost) based on a self-training framework. Its core is to extend the semi-supervised learning capability of XGBoost through a "pseudo-label iterative optimization + dual-criteria screening" mechanism to solve the problem of scarce labeled data in electricity theft detection.

[0122] The essence of STXGB is a self-trained model based on label iteration. By combining a single-base learner (XGBoost) with data similarity verification, it achieves the generation of highly reliable pseudo-labels and expansion of the annotation set.

[0123] Unlike traditional self-training, STXGB introduces dual constraints of model confidence and cosine similarity, significantly reducing pseudo-label noise, and is particularly suitable for the highly concealed nature and imbalanced sample distribution of electricity theft data. The STXGB workflow revolves around pseudo-label generation, validation, expansion, and iteration.

[0124] The basic steps of the algorithm are described as follows:

[0125] (1) Initialize the basic model

[0126] Input labeled dataset ( As for electricity consumption characteristics, (for electricity theft labels) and unlabeled datasets ;

[0127] Set hyperparameters: number of iterations (Determined through convergence experiments to ensure the model learns sufficiently), nearest neighbor number (Balancing voting reliability and computational efficiency), confidence threshold (Controlling the stringency of high-confidence sample screening);

[0128] Using labeled datasets Training the XGBoost base model This initial model provides a preliminary understanding of the characteristics of electricity theft.

[0129] (2) Pseudo-label generation and high-confidence sample screening

[0130] Model For unlabeled data Perform predictions and output pseudo-labels for each sample. and predicting the probability of electricity theft ;

[0131] Filter out the predicted probability of electricity theft The samples constitute the pseudo-labeled dataset to be confirmed. .

[0132] The purpose of high-confidence screening is to exclude samples that are obviously uncertain in the model and reduce the introduction of initial noise.

[0133] (3) Cosine similarity verification and secondary label generation

[0134] calculate Each sample in the labeled dataset Cosine similarity:

[0135]

[0136] in, 'b' is the electricity consumption feature vector of the sample to be confirmed, and 'b' is the feature vector of the labeled sample.

[0137] The reason for using cosine similarity instead of Euclidean distance is that the core characteristic of electricity theft is the abnormal electricity consumption pattern.

[0138] For example, normal users have low nighttime loads while users who steal electricity experience a sudden increase in nighttime loads, rather than differences in absolute load values, such as the difference in load magnitude between industrial and residential users.

[0139] Cosine similarity is sensitive to the direction of vectors but not to their magnitude, which can effectively eliminate the interference of differences in users' electricity consumption levels, making it more suitable for the business scenario of "focusing on abnormal electricity consumption patterns" in electricity theft detection.

[0140] For each sample to be confirmed, select the one with the highest similarity from the labeled dataset. A majority vote is conducted on each sample to generate secondary pseudo-labels. ( ).

[0141] The majority voting mechanism uses existing annotation information to verify the rationality of pseudo-labels and further filters out samples that are misjudged by the model.

[0142] (4) Dual-label consistency screening and annotation set expansion

[0143] Only keep Samples whose XGBoost predicted labels match the nearest neighbor voting labels are added to the labeled dataset, while those in the unlabeled dataset are removed.

[0144] This step ensures the reliability of the labels on the expanded samples through dual verification of model predictions and data distribution similarity.

[0145] (5) Iterative optimization and termination

[0146] With the updated labeled dataset Retrain the XGBoost model, repeating steps (2)–(4) until the number of iterations reaches [number missing]. The remaining unlabeled data proportion is less than 2.5%, which is about 1 / 40 of the initial labeled data size, to ensure that the expanded data covers a sufficient number of marginal distribution samples.

[0147] During the iteration process, the model continuously optimizes its fit to the characteristics of electricity theft as the labeled data expands, gradually improving its ability to identify concealed electricity theft samples.

[0148] As one possible implementation, the following embodiments verify and analyze the performance of STXGB under different electricity theft modes of the present invention:

[0149] To measure the performance of the model, a confusion matrix is ​​defined, which classifies all users into four categories: TP, FN, FP, and TN, based on their actual affiliation and the detected affiliation.

[0150] Specifically, TP indicates that the user is actually stealing electricity and has been detected as such.

[0151] FN indicates that the user is actually stealing electricity, but is detected as a normal user.

[0152] FP indicates that the user is actually a normal user, but is detected as a user stealing electricity.

[0153] TN indicates that the user is actually a normal user and has been detected as such.

[0154] The definition of precision is as follows.

[0155]

[0156] The recall rate is defined as follows: it reflects the proportion of all real positive examples that are correctly detected by the model. In the context of electricity theft detection, it reflects the ability of the electricity theft detection model to not miss any electricity theft users.

[0157]

[0158] The F1 score is defined as follows: it is the harmonic mean of precision and recall, used to comprehensively balance the performance of both.

[0159]

[0160] The ROC curve uses the false positive rate (x) is the x-axis, and the true rate ( (x) is the y-axis, describing the model's performance at different classification thresholds.

[0161] AUC is the area enclosed by the ROC curve and the coordinate axes. It primarily reflects the model's "ability to distinguish" between positive and negative examples, and its definition is as follows:

[0162]

[0163] Set up an electricity theft dataset This invention focuses on improving the accuracy of electricity theft detection models to reduce the costs of manual inspections and customer complaints caused by false positives. Within an acceptable range of missed detections, it maximizes accuracy. Therefore, the mathematical model for the electricity theft detection problem can be expressed as:

[0164]

[0165] In one embodiment, basic experiments were conducted on five constructed electricity theft datasets CT1 to CT5.

[0166] In the CT1, CT2, CT3, and CT4 datasets, the proportion of electricity theft samples (positive samples) is 10%, while in the CT5 dataset, the proportion of electricity theft samples is 30%.

[0167] In the data preparation stage, in order to reduce the impact of class imbalance of positive and negative samples on the model prediction performance, the Borderline-SMOTE algorithm is first used to process each electricity theft dataset to achieve a balance between positive and negative samples.

[0168] Then, the dataset is divided into labeled and unlabeled datasets in a 1:4 ratio. The unlabeled dataset is unlabeled data that was simulated in the real-world scenario by discarding the original labels during the semi-supervised training phase.

[0169] Secondly, a total of 787 anomalous features were generated using the TSFresh time series feature extraction framework, which were then reduced to 371 features through feature importance evaluation and correlation analysis.

[0170] To find the optimal parameters for the model, this embodiment uses a grid search method to traverse the given combination of hyperparameters.

[0171] The experimental results are shown in Table 2. The STXGB model has a score greater than 0.85 on all indicators on the CT1~CT5 datasets, with an average precision of 0.934, an average recall of 0.876, and an F1 score of 0.904, demonstrating excellent performance in detecting electricity theft.

[0172] Among them, the model showed excellent accuracy in the single electricity theft modes of CT1 to CT4, demonstrating the model's outstanding detection capability for single electricity theft modes.

[0173] In the CT5 hybrid electricity theft mode, the detection performance of the STXGB model decreased significantly. This is mainly because the detection of electricity theft is more difficult in the hybrid mode, requiring the detection model to learn the characteristics of multiple electricity theft modes at the same time.

[0174] Table 2 Experimental results of STXGB on CT1~CT5 datasets

[0175]

[0176] In one feasible embodiment, in order to fully verify the performance advantages of the STXGB model, a comparative experiment was conducted based on the CT5 hybrid electricity theft mode dataset.

[0177] Nine models were selected for comparison, including four supervised learning models: SVM, XGBoost, CNN, and Bi-LSTM, and five semi-supervised learning models: Tri-Training, TSVM, Label Spreading, CT-GAN, and SSL-AE.

[0178] The detailed parameter selection for each model adopts a combined strategy of "coarse screening followed by fine-tuning":

[0179] First, use Scikit-learn's RandomizedSearchCV to randomly sample in a wide range of hyperparameter spaces to lock in the potential optimal parameter range.

[0180] Then use GridSearchCV to perform a fine-grained exhaustive search within this interval.

[0181] The experimental results are shown in Table 3. On the CT5 hybrid electricity theft dataset, the STXGB model proposed in this invention ranked first in all three core metrics: precision of 0.893, recall of 0.851, and F1-score of 0.872, fully demonstrating its comprehensive advantages in electricity theft detection tasks.

[0182] Table 3. Experimental results of each model on the CT5 hybrid electricity theft dataset.

[0183]

[0184] This experiment comprehensively verified the technical advantages of STXGB in electricity theft detection tasks through multi-dimensional evaluation of precision, recall, and F1-score.

[0185] Its leading performance on the CT5 hybrid electricity theft dataset lays the foundation for generalization verification on subsequent real power grid datasets and provides an effective technical path for the application of semi-supervised learning in electricity theft detection.

[0186] In one embodiment, the adaptability and generalization performance of the STXGB model in a real power grid scenario are verified:

[0187] This embodiment introduces a real electricity consumption dataset published by SGCC (State Grid Corporation of China) to conduct cross-dataset verification experiments.

[0188] This dataset contains daily electricity consumption data from 42,372 real users, spanning from January 1, 2014 to October 31, 2016 (a total of 1,035 days). There is one sampling point per user per day. 3,615 users are identified as having stolen electricity in the dataset, which accounts for approximately 8.5% of the total electricity consumption data.

[0189] The comparison model for generalization verification is consistent with the above embodiments, selecting SVM, XGBoost, CNN, Bi-LSTM, Tri-Training, TSVM, Label Spreading, CT-GAN, SSL-AE, and the STXGB model of this invention.

[0190] All models use the optimal configuration of hyperparameters from the above embodiments, and accuracy is used as the core evaluation metric.

[0191] Combination Figure 4 and Figure 5 As shown, on the real SGCC dataset, the accuracy of all models showed varying degrees of change, but the STXGB model still maintained the best performance with an accuracy of 0.947, which is 3.4 percentage points higher than the basic model XGBoost (0.931) and 2.6 percentage points higher than the second-best model CT-GAN (accuracy of 0.921).

[0192] Among supervised deep learning models, Bi-LSTM has an accuracy of 0.906, slightly higher than CNN's 0.897; Tri-Training and SSL-AE have accuracy rates of 0.872 and 0.879 respectively, showing relatively weaker performance.

[0193] In-depth analysis reveals that the excellent generalization performance of the STXGB model on real datasets stems from two main aspects: First, its semi-supervised mechanism of pseudo-label iterative optimization and dual-criteria selection can effectively filter out natural noise in real data, reduce pseudo-label bias, and prevent the model from being interfered with by noise.

[0194] Secondly, STXGB is based on the XGBoost architecture, which is highly adaptable to large-scale sparse data, and at the same time captures the abnormal features extracted by TSFresh, adapting to complex electricity theft patterns in real-world scenarios.

[0195] For ROC curves, the closer the curve is to the top left corner, the higher the model's accuracy. STXGB's AUC value is 0.909, significantly higher than other models.

[0196] Therefore, the STXGB model not only performs well on artificially constructed mixed electricity theft pattern datasets, but also maintains its leading advantage on real power grid datasets containing natural noise and complex electricity theft patterns, with stable performance improvement, which fully demonstrates its good generalization ability and adaptability to the electricity theft detection needs of actual power grids.

[0197] In one embodiment, to clarify the actual contribution of each core module of the semi-supervised mechanism in the STXGB model to the electricity theft detection performance, the interference of performance improvement due to parameter tuning or data deviation is eliminated.

[0198] In this embodiment, an ablation experiment was designed. The experiment used the complete STXGB model as a benchmark and constructed a comparative model by removing the semi-supervised core modules one by one.

[0199] Under the conditions of the real electricity consumption dataset published by SGCC and the same hyperparameters (tolerance_number = 5, n_neighbors = 5, iter_rate = 0.001), the F1 scores of each model are compared to verify the effectiveness of the semi-supervised mechanism.

[0200] STXGB's semi-supervised mechanism consists of three core modules: single-base learner, pseudo-label iterative optimization, and cosine similarity verification. Ablation experiments designed comparative models for each of these three modules.

[0201] The complete STXGB serves as a performance benchmark, demonstrating the synergistic effect of all modules.

[0202] Ablation model A removes cosine similarity verification, which can verify whether secondary pseudo-label screening based on cosine similarity can reduce pseudo-label noise.

[0203] Ablation model B removes all semi-supervised modules, which can verify whether the semi-supervised mechanism is superior to pure supervised learning overall.

[0204] Table 4 Comparison of Ablation Test Performance Results

[0205]

[0206] The results are shown in Table 4. All indicators are the average of three repeated experiments to ensure the stability of the results.

[0207] The F1 score of ablation model A (without secondary confirmation) was 0.853, a decrease of 5.12% compared to the complete STXGB. This difference is due to the fact that when relying solely on model prediction confidence to screen for false labels, there are cases where normal users are mistakenly identified as electricity thieves due to short-term fluctuations in electricity consumption.

[0208] By calculating the cosine similarity between labeled samples and high-confidence pseudo-labeled samples, misjudged samples are filtered out to some extent through "similarity voting based on electricity consumption patterns".

[0209] Compared with the basic XGBoost, the F1 score of XGBoost without the semi-supervised mechanism is 0.842, which is 1.29% lower than the F1 score of the ablation model A, verifying the effectiveness of the pseudo-label iterative self-learning framework based on high confidence.

[0210] In summary, we conducted experiments comparing our model with nine other models: SVM, XGBoost, CNN, Bi-LSTM, Tri-Training, TSVM, LabelSpreading, CT-GAN, and SSL-AE.

[0211] Experiments demonstrate that the model proposed in this invention has higher detection accuracy in both single and mixed electricity theft modes, and the STXGB model has good generalization performance on the dataset released by SGCC.

[0212] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0213] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A self-trained semi-supervised electricity theft detection method based on XGBoost, characterized in that, This method combines XGBoost to construct a self-learning semi-supervised detection model, STXGB; it includes the following steps: The user's raw electricity consumption data is collected and preprocessed to construct the user's electricity load time series; the preprocessing includes time seriesification, dirty data processing and missing value processing. Anomaly feature processing is performed based on TSFresh time series features, and new features are generated using feature functions. The characteristic functions include basic statistical functions, distribution characteristic functions, trend characteristic functions, fast Fourier functions, and autocorrelation characteristic functions; Based on the new features, random forest is used to evaluate the importance of features, and Pearson correlation coefficient is used to analyze feature correlation and remove redundant features; the new features include mean, median, standard deviation, skewness and kurtosis; The new features after removing redundant features are randomly selected and passed through the electricity theft attack function to generate electricity theft samples. The Borderline-SMOTE method is used to balance positive and negative samples, and combined with a larger proportion of unlabeled data, the STXGB detection model is trained. After the online data undergoes preprocessing and anomaly feature processing and feature selection, it is input into the STXGB detection model, which outputs suspicious users.

2. The self-trained semi-supervised electricity theft detection method based on XGBoost according to claim 1, characterized in that, The preprocessing steps include: The user's daily electricity load data is time-series processed, and the data from each sampling point are grouped according to the metering point number and sorted within the group according to the time sequence. Each group contains the electricity consumption time series of a user within one cycle. Because the measurement data contains dirty data and null values, that is, all sampling points are zero, the dirty data is deleted through the dirty data processing. The missing value processing uses the Grange interpolation method to fill in the missing values; Specifically, five data points before and after the missing value are extracted, and the extracted ten data points are grouped together to generate the missing value based on the Lagrange difference formula; The formula for the Grange difference: ； Where, in the formula Representing the One data point; Represents sample values; It is a Lagrange polynomial.

3. The self-trained semi-supervised electricity theft detection method based on XGBoost according to claim 1, characterized in that, The ratio of randomly selected samples after preprocessing and abnormal feature processing is a preset fixed ratio; The sampling ratio of the unlabeled data is greater than the grouping ratio of the samples after preprocessing and anomaly feature processing; The balanced samples and the unlabeled data together constitute the complete training dataset of the STXGB detection model.

4. The self-trained semi-supervised electricity theft detection method based on XGBoost according to claim 1, characterized in that, The specific steps for training the STXGB detection model include: Input labeled and unlabeled datasets, set hyperparameters, and train the base model using the labeled dataset; the hyperparameters include the number of iterations, the number of nearest neighbors, and the confidence threshold. Based on the basic model, pseudo-labels and predicted electricity theft probabilities are obtained from the unlabeled dataset. Samples whose predicted electricity theft probabilities do not drop the threshold are selected to form a pseudo-labeled dataset to be confirmed. Calculate the cosine similarity between the pseudo-labeled dataset and the labeled dataset, select the 5 samples with the highest similarity in the labeled dataset for majority voting, and generate secondary pseudo-labels; Samples whose pseudo-labels are equal to the secondary pseudo-labels are selected and expanded into the labeled dataset, while those in the unlabeled dataset are removed. The base model is retrained based on the expanded labeled data, and the above steps are repeated until the iteration termination condition is met.

5. The self-trained semi-supervised electricity theft detection method based on XGBoost according to claim 4, characterized in that, The iteration termination conditions include: The iteration count reaches 100 or the remaining proportion of unlabeled data is less than 2.5%; The remaining proportion is 1 / 40 of the initial labeled data size.

6. The self-trained semi-supervised electricity theft detection method based on XGBoost according to claim 1, characterized in that, The steps for generating electricity theft samples include: Randomly select the electricity consumption time series of a normal user from the preprocessed and abnormal feature-processed samples, and randomly sample 10% of the data from it as the basis for sample generation; Based on four preset electricity theft functions, the randomly sampled data is modified to generate four labeled datasets for electricity theft modes, and a mixed labeled dataset containing the four electricity theft modes is also generated.

7. The self-trained semi-supervised electricity theft detection method based on XGBoost according to claim 1, characterized in that, The steps for outputting suspicious users include: Technical personnel were dispatched to conduct on-site verification of the electricity usage of the suspected users. If the verification confirmed that a user was stealing electricity, the corresponding load data was marked with an electricity theft label. If the verification found that a user was not stealing electricity, the corresponding data was marked with a normal label. The data from the electricity theft tags and normal tags are expanded into the tag dataset, and the STXGB detection model is retrained and evaluated based on the expanded tag dataset.

8. A training method for a self-learning semi-supervised detection model STXGB, characterized in that, Includes the following steps: The original electricity consumption dataset of users is obtained as a training sample, and the training sample is input into a general module for processing. The general module includes data preprocessing and anomaly feature processing based on TSFresh time series features, and redundant features are removed by evaluating feature importance through random forest and combining Pearson correlation coefficient. Randomly select a portion of the samples processed by the general module, and generate electricity theft samples based on the electricity theft attack function; The Borderline-SMOTE method is used to balance positive and negative samples to obtain a balanced sample set, while a larger proportion of unlabeled data is randomly sampled. The balanced sample set and the unlabeled data are input into the STXGB detection model to train the STXGB detection model.

9. An electronic device, comprising: The processor, communication interface, memory, and communication bus are connected, with the processor, communication interface, and memory communicating with each other via the communication bus. The memory stores a computer program, which, when executed by the processor, causes the processor to perform a self-trained semi-supervised electricity theft detection method based on XGBoost as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements a self-trained semi-supervised electricity theft detection method based on XGBoost as described in any one of claims 1 to 7.

Images