Power consumption data anomaly detection method and device based on decoupling anomaly injection driving

Abstract

The invention discloses a power consumption data anomaly detection method and device based on decoupling anomaly injection driving. The method comprises the following steps: injecting predefined multiple types of pseudo anomalies into a normal data window to generate a pseudo anomaly window; the method comprises the following steps: pre-training a pre-constructed submerged space hybrid anomaly expert network model architecture, and generating a shared encoder, a normal decoder, an anomaly decoder and a plurality of anomaly expert networks of a hybrid anomaly expert network of a submerged space hybrid anomaly expert network model; learning a routing network and a classification head of the hybrid anomaly expert network, and generating a routing network and a classification network of a submerged space hybrid anomaly expert network model; calculating a reconstruction error of to-be-tested data at each time point and an anomaly probability output by the classification network based on a sliding window by adopting a submerged space hybrid anomaly expert network model, and performing linear combination to obtain a point-by-point anomaly score; and judging the point-by-point anomaly score according to a set threshold value to obtain an anomaly detection result.

Description

Technical Field

[0001] This invention relates to the field of electricity metering technology, and more specifically, to a method and apparatus for detecting abnormal electricity consumption data based on decoupled abnormal injection driving. Background Technology

[0002] Electricity data is a key indicator for understanding the energy industry and macroeconomic operations, playing a central role in economic situation assessment and policy effectiveness evaluation. Currently, the company's electricity information collection system has achieved full access to smart meters of all electricity users within its operating area—these smart terminals, distributed at the user end, can collect electricity consumption and data at a fine-grained time level, such as daily or hourly. As the company's sole source of user electricity information, this system has accumulated a massive electricity user database over the long term, providing crucial support for precise analysis of user energy consumption characteristics, real-time monitoring of grid operation status, and serving national-level electricity data research. However, facing the processing demands of massive amounts of electricity data, coupled with the stringent timeliness requirements in professional scenarios, current anomaly screening still mainly relies on fixed threshold judgments set by experts based on experience, and has not yet developed an intelligent identification solution with strong anti-interference capabilities and sensitive anomaly response.

[0003] In electricity consumption time series data, anomalies are often sparsely distributed and mixed in with a large amount of normal data, making accurate labeling difficult. Therefore, unsupervised methods are currently the primary approach for anomaly detection. While classic unsupervised anomaly detection methods have been applied to electricity consumption data anomaly detection, they neglect the temporal structure of time series data, resulting in an inability to capture the contextual dependencies and complex nonlinear relationships of the time series. Recently, deep learning-based time series anomaly detection methods have been proposed and have demonstrated high anomaly detection capabilities. Deep learning-based time series anomaly detection methods can be broadly categorized into prediction-based, correlation-difference-based, density-estimation-based, and reconstruction-based methods. Among these, reconstruction-based methods have shown better adaptability and robustness on multiple real-world public multidimensional time series datasets compared to other paradigms, and have become the mainstream research direction in the field of unsupervised multidimensional time series anomaly detection.

[0004] Reconstruction-based methods heavily rely on the assumption that training data contains only normal data, using the larger reconstruction error of outlier data compared to normal data to identify positive anomalies. However, because the actual collection process of electricity consumption data is easily disturbed, the training data may be corrupted by unknown outliers or noise. The normality assumption of current mainstream reconstruction-based anomaly detection methods is not always applicable in the real world. Although existing electricity consumption data time series anomaly detection methods suppress the impact of contaminated data on model learning or constrain the model to learn more accurate positive anomaly pattern boundaries through methods such as contamination suppression or anomaly injection, these methods often exhibit poor robustness and generalization ability when facing complex and variable real-world scenarios.

[0005] Contamination suppression methods mitigate the negative impact of anomalous contamination on model learning through explicit design at the model level, such as introducing memory modules, or adjusting loss weights during training. However, while suppressing the model's learning of anomalous patterns, these methods inevitably sacrifice the model's understanding of some complex normal patterns, leading to an increased false positive rate. Anomaly injection methods attempt to introduce general anomaly knowledge, using artificial scale perturbations, temporal perturbations, and noise interference to simulate pseudo-anomaly data such as point anomalies and pattern anomalies, and then combining this with self-supervised reconstruction and classification tasks to learn more accurate positive anomaly pattern boundaries. However, different data domains have different data patterns. Although anomaly injection can alleviate the anomalous contamination problem in training data when pseudo-anomalies are similar to contaminated anomalies within the data domain, pseudo-anomalies generated based on general anomaly knowledge may be normal samples within the data domain, leading to the model learning incorrect positive anomaly boundaries; or they may be anomalous samples that significantly deviate from normal data patterns, contributing nothing to the learning of positive anomaly pattern boundaries. Existing methods lack an understanding of the potential domain-specific anomalous knowledge within the training data. Furthermore, for mixed variable data containing both continuous and discrete variable dimensions, existing anomaly injection methods do not distinguish between injection methods and ignore the fact that injection methods such as time perturbation and noise interference are not suitable for discrete variable dimensions.

[0006] The normality assumption of current mainstream reconstruction-based anomaly detection methods does not always apply in the real world. When the training data is contaminated, reconstruction-based anomaly detection methods face the problem of unexpected generalization of anomalies by the model, leading to a lack of distinction between positive anomalies and affecting anomaly detection performance. Existing anomaly detection methods for handling contaminated training datasets mainly focus on two technical approaches: contamination suppression and anomaly injection. Although these methods improve the robustness of the model to some extent, the following problems still limit further performance improvement: 1) Contamination suppression methods, while suppressing the model's learning of anomalous patterns, inevitably sacrifice the model's understanding of some complex normal patterns. 2) Anomaly injection methods lack an understanding of the potential domain-specific true anomaly knowledge in the training data. Pseudo-anomalies generated based solely on general anomaly knowledge may be normal samples within the data domain, causing the model to learn incorrect positive anomaly boundaries; or they may be anomalous samples that significantly deviate from normal data patterns, contributing nothing to the learning of positive anomaly pattern boundaries. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides a method and apparatus for detecting power consumption anomalies based on decoupled anomaly injection driving.

[0008] According to one aspect of the present invention, a method for detecting power consumption data anomalies based on decoupled anomaly injection is provided, comprising: Inject predefined pseudo-exceptions of various types into the normal data window to generate a pseudo-exception window; The pre-built latent space hybrid anomaly expert network model architecture is pre-trained based on normal data windows and pseudo-anomaly windows to generate a shared encoder, normal decoder, anomaly decoder, and multiple anomaly expert networks of the latent space hybrid anomaly expert network model. Based on a shared encoder, normal decoder, abnormal decoder, and multiple abnormal expert networks, the routing network and classification head of the hybrid abnormal expert network are learned to generate the routing network and classification network of the latent space hybrid abnormal expert network model. A latent space hybrid anomaly expert network model is adopted. Based on the sliding window, the reconstruction error of the test data at each time point and the anomaly probability output by the classification network are calculated, and the point-by-point anomaly score is obtained by linear combination. The anomaly scores are determined point by point based on the set threshold to obtain the anomaly detection results.

[0009] According to another aspect of the present invention, a power consumption data anomaly detection device based on decoupled anomaly injection drive is provided, comprising: The first generation module is used to inject predefined pseudo-exceptions of various types into the normal data window and generate a pseudo-exception window. The second generation module is used to pre-train the pre-built latent space hybrid anomaly expert network model architecture based on the normal data window and the pseudo-anomaly window, and generate the shared encoder, normal decoder, anomaly decoder and multiple anomaly expert networks of the latent space hybrid anomaly expert network model. The third generation module is used to learn the routing network and classification head of the hybrid anomaly expert network based on multiple anomaly expert networks, including a shared encoder, a normal decoder, an anomaly decoder, and a hybrid anomaly expert network, to generate the routing network and classification network of the latent space hybrid anomaly expert network model. The calculation module is used to calculate the reconstruction error of the test data at each time point and the anomaly probability output by the classification network based on the latent space hybrid anomaly expert network model, and obtain the point-by-point anomaly score by linear combination. The judgment module is used to judge the point-by-point anomaly score according to the set threshold and obtain the anomaly detection result.

[0010] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing a computer program for performing the methods described in any of the above aspects of the present invention.

[0011] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the method described in any of the preceding aspects of the present invention.

[0012] Therefore, this invention proposes a two-stage unsupervised reconstruction-classification framework that integrates general anomaly knowledge and latent anomaly knowledge within the data domain. Based on a structured separation and decomposition time-frequency anomaly injection method and a latent space hybrid anomaly expert module, it fully utilizes both general anomaly knowledge and real latent anomaly knowledge within the data domain. The structured separation and decomposition time-frequency anomaly injection method injects different general anomaly patterns from the time-frequency domain only for continuous variable dimensions, generating more essential and diverse pseudo-anomaly samples. The latent space hybrid anomaly expert module is based on a step-by-step training strategy. It first uses a hard routing mechanism to train different experts to acquire specialized capabilities for different general anomaly patterns, and then combines latent anomaly knowledge within the data domain to train a dense gating network to explicitly simulate complex real anomalies. These designs and jointly optimized reconstruction-classification proxy tasks enable the two-stage unsupervised reconstruction-classification framework to achieve robust training even under training data contamination conditions. Attached Figure Description

[0013] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures: Figure 1This is a flowchart illustrating an exemplary embodiment of the present invention for a method of detecting abnormal power consumption data based on decoupled anomaly injection driving. Figure 2 This is a schematic diagram of the overall process of a power consumption data anomaly detection method based on decoupled anomaly injection driving provided by an exemplary embodiment of the present invention; Figure 3 This is a flowchart of the separation and decomposition time-frequency anomaly injection module provided in an exemplary embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of an electricity data anomaly detection device based on decoupled anomaly injection drive provided in an exemplary embodiment of the present invention; Figure 5 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. Detailed Implementation

[0014] Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. It is obvious that the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention, and it should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0015] It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0016] Those skilled in the art will understand that the terms "first," "second," etc., in the embodiments of the present invention are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a necessary logical order between them.

[0017] It should also be understood that in the embodiments of the present invention, "multiple" can refer to two or more, and "at least one" can refer to one, two or more.

[0018] It should also be understood that any component, data or structure mentioned in the embodiments of the present invention can generally be understood as one or more unless explicitly defined or given contrary instructions in the context.

[0019] Furthermore, the term "and / or" in this invention is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this invention generally indicates that the preceding and following related objects have an "or" relationship.

[0020] It should also be understood that the description of the various embodiments in this invention emphasizes the differences between the various embodiments, and the similarities or similarities can be referred to each other. For the sake of brevity, they will not be described in detail.

[0021] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0022] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the invention or its application or use.

[0023] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, they should be considered part of the specification.

[0024] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0025] The embodiments of this invention can be applied to electronic devices such as terminal devices, computer systems, and servers, and can operate together with a wide range of other general-purpose or special-purpose computing system environments or configurations. Well-known examples of terminal devices, computing systems, environments, and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, and servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments including any of the above systems, etc.

[0026] Electronic devices such as terminal devices, computer systems, and servers can be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are executed by remote processing devices linked through communication networks. In distributed cloud computing environments, program modules can reside on local or remote computing system storage media, including storage devices.

[0027] Exemplary methods Figure 1 This is a schematic flowchart of a power consumption data anomaly detection method based on decoupled anomaly injection driving, provided by an exemplary embodiment of the present invention. This embodiment can be applied to electronic devices, such as... Figure 1 As shown, the power consumption data anomaly detection method 100 based on decoupled anomaly injection driver includes the following steps: Step 101: Inject various predefined types of pseudo-exceptions into the normal data window to generate a pseudo-exception window; Step 102: Pre-train the pre-built latent space hybrid anomaly expert network model architecture based on the normal data window and the pseudo-anomaly window to generate the shared encoder, normal decoder, anomaly decoder, and multiple anomaly expert networks of the latent space hybrid anomaly expert network model. Step 103: Based on multiple anomaly expert networks including a shared encoder, a normal decoder, an anomaly decoder, and a hybrid anomaly expert network, the routing network and classification head of the hybrid anomaly expert network are learned to generate the routing network and classification network of the latent space hybrid anomaly expert network model. Step 104: Using a latent space hybrid anomaly expert network model, the reconstruction error of the test data at each time point and the anomaly probability output by the classification network are calculated based on a sliding window, and the point-by-point anomaly score is obtained by linear combination. Step 105: Determine the point-by-point anomaly score based on the set threshold to obtain the anomaly detection result.

[0028] Specifically, this invention differs from existing time-series anomaly detection methods by combining general anomaly knowledge with latent anomaly knowledge within the training data domain for the first time, and simulating more realistic pseudo-anomalies. Considering that discrete dimensions with complex mixed variable patterns and lower information density are unsuitable for anomaly injection, this invention designs nine time-frequency anomaly injection operators based on general knowledge to inject pseudo-anomalies in continuous dimensions. During the pre-training phase, an expert network corresponding one-to-one with the pseudo-anomalies is paired with a hard-route unfreezing training strategy to allocate diverse pseudo-anomalies, ensuring that different expert networks can learn to generate different types of general pseudo-anomaly patterns after pre-training. During the detection training phase, to fully utilize the latent domain-specific anomaly knowledge in the training data, a threshold strategy combining latent space density and window-level reconstruction error is designed to mine latent anomaly samples. Subsequently, this invention designs a training branch that, while freezing anomaly experts with comprehensive general anomaly knowledge, uses the selected latent anomaly samples in the data domain to constrain the dense router of the mixed anomaly expert module to simulate real anomaly samples in the current data domain. Simultaneously, this invention jointly optimizes the normal sample reconstruction task and the latent space positive anomaly pattern classification task, achieving excellent anomaly detection performance even when the training data is contaminated.

[0029] This invention proposes a method for detecting anomalies in electricity consumption data (TSMoAE) that combines general anomaly knowledge with latent domain anomaly knowledge in the training dataset. Figure 2 As shown, TSMoAE comprises a two-stage training process. Stage A includes... Figure 2The separation and decomposition time-frequency anomaly injection process shown in (a) and the pre-training process of the hybrid anomaly expert shown in (b) first inject nine types of pseudo-anomalies into the original subsequence window based on general anomaly knowledge and combined with the separation and decomposition time-frequency injection strategy, resulting in anomaly windows. Then, the surrogate tasks of normal window reconstruction and anomaly window reconstruction are used to constrain the shared encoder to learn meaningful representation information, and the anomaly labels of the pseudo-anomaly windows are used to train the corresponding nine expert networks, thereby ensuring that different expert networks can learn to generate different types of pseudo-anomaly latent variables. Stage B includes Figure 2 The pseudo-label generation process shown in (c) and the training process for the reconstruction and classification tasks shown in (d) first utilize the normal window encoder-decoder trained in stage A to generate pseudo-labels for all training windows in the current dataset based on the window reconstruction error and latent space density, distinguishing normal windows from potentially anomalous windows. Then, the normal window decoder is fine-tuned to eliminate the negative impact of potentially anomalous data on the reconstruction task. Simultaneously, domain anomaly knowledge from potential anomalies is used as a constraint to train a hybrid anomaly expert routing network, enabling it to integrate the anomaly generation capabilities of multiple experts to generate more realistic and reliable anomalies within the current data domain. This allows the classification head to learn more accurate decision boundaries. During the testing phase, the anomaly score consists of the reconstruction error and the class score, and anomaly detection is performed according to a set threshold.

[0030] 1. Separate decomposition time-frequency anomaly injection like Figure 3 As shown, the time-frequency anomaly injection module decomposes each window into continuous and discrete variables, facilitating subsequent anomaly injection targeting only the continuous variable dimension. Specifically, compared to continuous features, discrete features have a finite number of possible values. Therefore, without using prior knowledge, it is necessary to count the number of identical values ​​in each feature and, based on the set dispersion... To determine whether a feature is discrete in dimension, the original window... Divided into and Meanwhile, considering the diverse anomaly patterns and the possibility of different types of anomalies occurring simultaneously, a simple and easily implemented moving average is used to integrate continuous-dimensional variables in order to enable subsequent anomaly expert networks to learn more fundamental anomaly knowledge. Trend-residual decomposition was then performed to obtain smoother trend components. and high-frequency details with more dramatic fluctuations As shown in the following formula: in, This represents the padding operation at both ends to ensure that the length of the sequence remains unchanged before and after decomposition. This represents a moving average.

[0031] For the low-frequency trend component, consider perturbing its pattern from a frequency domain perspective. Regarding the first... Trend components decomposed from continuous dimensions Perform a real-number fast Fourier transform (rFFT) to obtain... ,in To fully utilize general anomaly knowledge and generate diverse pattern anomalies, four frequency domain anomaly injection operators were designed, as follows: (1) Low-frequency amplitude scaling: in, Random scaling factor, random bandwidth ; (2) High-frequency cutoff: Among them, random cutoff frequency ; (3) Low-frequency amplitude averaging: Among them, random bandwidth , ; (4) Low-frequency drift: Among them, random bandwidth Independent noise After performing the aforementioned frequency domain anomaly injection, it can be obtained through inverse transformation. .

[0032] For high-frequency residual components, anomaly injection is considered from a time-domain perspective. Similarly, to generate diverse point anomalies and pattern anomalies, for the first... Residual components decomposed from continuous dimensions Five time-domain anomaly injection operators were designed, as follows: (1) Peak : in, Indicates a random position. For random peak amplitude, Represents the impulse function; (2) Flip: in, Represents a random segment; (3) Gearbox: in, Represents the speed change factor, when When the time series is accelerated, the time series is accelerated, and vice versa. Slow down, Represents a random segment. ; (4) Reverse: in, Represents a random segment; (5) Adding noise: Among them, channel scale random, .

[0033] Specifically, for windows After separation and decomposition, in order to ensure the diversity and randomness of abnormal patterns, random selection is performed before each injection. Each dimension is considered, and the corresponding exception injection operator is selected based on the preset exception type. The exception injection only occurs within the selected dimension set. Injection is performed on the top layer. After anomaly injection is completed, the trend-residual components are resynthesized to obtain the anomaly continuous dimension, and then the discrete dimension is spliced ​​together. Obtain the final exception window In addition, the preset process for exception types evenly distributes the number of exceptions corresponding to the 9 types of operators, and retains the corresponding exception type labels, so that each expert can fully learn on the exception patterns they are good at.

[0034] 2. Pre-trained anomaly experts Unlike existing methods that design anomaly injection mathematical functions solely based on general anomaly knowledge, TSMoAE combines the general anomaly knowledge from the decomposed time-frequency anomaly injection module to design a latent space hybrid anomaly expert network. Specifically, considering the randomness of anomaly injection using mathematical methods, directly learning anomaly generation experts in the original time domain can easily lead to anomaly pattern learning collapse, and experts may struggle to understand the essential representations of anomaly patterns. Therefore, TSMoAE trains experts in the latent space encoded by the encoder. Based on the structured representations after feature extraction, the optimization process of the expert network is more stable. Furthermore, during the pre-training phase, a hard-route distribution method is used to select experts based on the type of injected anomaly, ensuring that each expert is fully specialized in their corresponding anomaly pattern. In addition, to avoid the encoder learning meaningless representations, a dual-branch reconstruction task is designed to constrain the encoder to capture high-level representations of electricity consumption data.

[0035] like Figure 2 As shown in (b), specifically, given a normal window sample and the anomalous window samples injected after separation and decomposition of time-frequency anomalies in a structured manner. First, send the two types of windows to the shared encoder respectively. In this process, the latent variables are obtained as shown in the following equation: in, and These represent the latent variables for the normal and abnormal windows, respectively. It uses 1D convolutional blocks stacked with 4 layers, each convolutional block including Normalization and activation function The shared encoder ensures the consistency of the latent space containing latent variables and is a prerequisite for training the subsequent anomaly expert network. Then, the routing network within the hybrid anomaly expert module is frozen, and a hard routing distribution mechanism based on anomaly injection type is adopted. Let the expert set corresponding to the nine types of structured anomaly injection be denoted as . (In this invention) When an abnormal window The corresponding exception label is At that time, freeze other experts and normal latent variables. Send to the appropriate expert and with abnormal latent variables As a teacher signal, updating experts The parameters enable it to learn the first... The representation pattern corresponding to the class of exceptions is shown in the following formula: in, It has a two-layer MLP structure. This represents the alignment loss between expert-generated latent variables and anomalous latent variables. This indicates a stop gradient, ensuring that the gradient flow from the training expert does not perturb the encoder in the reverse direction. Simultaneously, to avoid the tendency of a single decoder to "compromise reconstruction" between the normal and abnormal domains, this invention configures two independent reconstruction branches for the shared encoder: a normal decoder and a normal decoder. Responsible for The normal window is decoded and reconstructed to obtain... And the exception decoder Responsible for decoding The reconstructed exception window is obtained. The task is reconstructed using mean square error constraints, as shown in the following equation: in, by and It consists of symmetrical stacked 4 layers of 1D convolutional blocks. This represents the normal window reconstruction loss. This represents the loss for reconstructing the abnormal window. The dual reconstruction task constrains the shared encoder to learn meaningful high-level representations without falling into the trap of identity mapping. Finally, the overall objective function for the pre-training phase is shown in the following equation: in, This is used to balance the impact of abnormal reconstruction and expert learning on the overall network training.

[0036] After completing Phase A, we obtained a set of codecs with strong reconstruction capabilities in the normal domain, as well as a group of experts proficient in various abnormal patterns of 9 types in the latent space, providing reusable and composable basic modules for route learning and discriminative modeling in the subsequent Phase B.

[0037] 3. Pseudo-label construction and reconstruction - joint training for classification To fully utilize the potential domain anomalies in the training data, TSMoAE first freezes the encoder-decoder trained in stage A during the pseudo-label generation stage in stage B, and uses two complementary metrics, reconstruction error and latent space density, to... Each sliding window in the process is pseudo-labeled to distinguish between normal samples and potentially anomalous samples. It's worth noting that although the encoder-decoder trained in stage A is affected by potential anomalous samples, the purpose of the pseudo-label generation stage is not to perform point-by-point anomaly detection, but rather to select more realistic anomalous windows as reference samples for subsequent training through a robust threshold strategy. Afterwards, all anomaly experts in the hybrid anomaly expert module are frozen. The routing network is trained by constraining potential anomalous samples to simulate real anomalous samples in the current data domain. Finally, the classification network is trained. Positive anomalies are distinguished from those in the latent space. Meanwhile, to minimize the negative impact of potential anomalous samples on the reconstruction task, only windows with pseudo-labels of normal are used to fine-tune the decoder in stage B. .

[0038] like Figure 2 As shown in (c), specifically, for the subsequence window The first in window After being processed by the encoder and decoder, The mean squared error is used as the reconstruction error for this window, as shown in the following formula: in, Indicates the first Reconstruction error of each window, Indicates the first Latent variables for each window. Simultaneously, latent variables for all windows of the MTS sequence. Using K-Means to obtain Centroid and in the centroid set Create an index on top and calculate each latent variable. arrive The Euclidean distances between the nearest centroids are averaged to measure the latent space density. As shown in the following formula: in, express The set of indices of the nearest centroid. The larger, the more The lower the density in the latent space, the better. Considering... large and Large samples are difficult to reconstruct and are far from the main clusters in the latent space, making them more likely to be potential anomalous samples. Big but Smaller samples are more likely to represent normal patterns that are difficult to learn. Therefore, we use a robust quantile threshold strategy, recording... , They are respectively , of Quantic sites are defined with three types of pseudo-labels as follows: in, and These represent normal and difficult-to-learn normal windows, respectively. This indicates a potential abnormal window.

[0039] With pseudo-tags, such as Figure 2 As shown in (d), the shared encoder is frozen. With all anomaly expert networks The focus of training shifts to the routing network. Classification network and normal decoder Unlike sparse MoEs common in the LLM field, this stage does not address routing networks. Instead of imposing entropy penalties or Top-k truncation on the weights, a dense MoE model is adopted to ensure that simulated anomalies output by multiple experts more closely resemble real anomaly patterns. Specifically, let a batch of sliding windows be... Its pseudo-labels First, normal latent variables are obtained by freezing the encoder. and potential abnormal latent variables As shown in the following formula: Then, in each normal latent variable The above calculation of the routing network output The mixed weights of the experts are calculated, and the output of the frozen expert network is used to obtain the simulated anomaly latent variables. This is illustrated in the following equation: in, For a single simulated anomalous latent variable, This is to simulate an anomaly set. To ensure the realism of the simulated anomalies, and to compare the losses... Constrained routing networks This ensures that the general anomaly knowledge already learned by experts and the potential anomaly knowledge within the current data domain are fully utilized. As shown in the following formula: in, This indicates the number of simulated anomalies generated. Indicates temperature. This indicates that gradient descent should be stopped to prevent invalid gradients from being backpropagated to the frozen encoder. Finally, simulated anomalies are explicitly added to the classification training set as additional anomaly samples, and cross-entropy loss is used. The classification head is trained to learn more reliable classification boundaries between normal and abnormal patterns. As shown in the following equation: in, The constructed classification training set, This indicates that gradient descent has stopped to prevent the classification head gradient from back-interfering with the routing network. Training. Simultaneously, pseudo-labels are used. The reconstruction error of normal samples (0 or 1) is used to constrain the fine-tuning decoder. As shown in the following formula: Therefore, the overall objective function for stage-B is as follows: in, is the tradeoff coefficient between cross-entropy loss and contrast loss.

[0040] 4. Abnormal Scores and Detection During the testing phase, there is no need for anomaly injection or simulation of latent anomalous variables. This is because, after training, a codec capable of reconstructing normal patterns and a classification head capable of distinguishing positive latent anomalous variables have already been obtained. Therefore, the anomaly score consists of two parts: the reconstruction error and the anomaly probability given by the classification head. Since point-level anomaly detection is required, unlike the window-level reconstruction error used in the pseudo-label construction phase of Section 5.4, in the testing phase, based on a sliding window with a step size of 1, the reconstruction error at the end of each window's time point is taken to obtain the point-by-point reconstruction score, as shown in the following formula: in, Indicates the first Reconstruction window The end point in time, Indicates the first The reconstruction error at each time point. Similarly, the anomaly probability output by the classification head for each window is used as the anomaly probability at the end time point of each window, as shown in the following formula: in, Indicates the first The anomaly probability at each time point. Finally, the reconstruction error is linearly combined with the anomaly probability to obtain the point-by-point anomaly score as shown below: in, This is the coefficient of the anomaly probability output by the classification head.

[0041] Based on point-by-point outlier scores Anomaly detection is performed using the set optimal threshold. When If the threshold is exceeded, an anomaly is considered to have occurred at that time point; otherwise, the current time point is considered to be in a normal state, as shown in the following formula: in, Represents binary operations. This indicates the optimal threshold selected by iterating through the thresholds.

[0042] In a specific embodiment of the present invention, the present invention compares TSMoAE with 11 more advanced models on 5 authoritative real-world datasets representing the diversity of time series data distribution and 1 actual electricity consumption dataset, respectively, to verify the effectiveness and advancement of the proposed multi-dimensional time series electricity consumption data anomaly detection method.

[0043] 1) Evaluation indicators AUC-ROC was selected as the evaluation metric to assess the performance of the proposed method and the baseline. AUC-ROC is a commonly used metric in anomaly detection, representing the area under the receiver operating characteristic curve (ROC) with FPR (False Positive Rate) and TPR (True Positive Rate) as the x and y axes, obtained at different thresholds. AUC-ROC directly reflects the anomaly detection performance of the algorithm after excluding the influence of the threshold. Its range is from 0 to 1; a perfect algorithm has an AUC-ROC value of 1, while a random guessing model has an AUC value close to 0.5. The formulas for calculating TPR and FPR are shown below: in, (True Postive) and (False Positive) represents the number of true anomaly time points and false anomaly time points detected, respectively. (True Negative) and (False Negative) represents the number of true normal time points and false normal time points detected, respectively.

[0044] 2) Comparison Method This invention compares the proposed method with 11 multivariate time series anomaly detection methods, including traditional machine learning methods: LOF, Isolation Forest (IF); prediction-based methods: GDN, GTA; and reconstruction methods: MSCRED, USAD, TranAD, AT, RAE, DiffAD, and TSMAE.

[0045] 3) Implementation details A sliding time window approach was used to divide the training and testing time window sets, with a sliding time window length of 100 and a step size of 1 for both training and testing. TSMoAE was implemented based on Python 3.9 and PyTorch 2.0, and all experiments were run on a server equipped with an Intel(R) Core(TM) i9-10900X 3.70GHz CPU and an NVIDIA GeForce RTX 3090 GPU. It was trained with an initial learning rate of 5e-4 and a weight decay rate of 1e-5 using the AdamW optimizer, and an early stopping strategy was employed: if the loss on the validation set did not decrease for 10 consecutive epochs, early stopping was triggered.

[0046] 4) Introduction to Public Datasets Five real-world datasets from three application areas were used. The datasets consist of monitoring data from multiple complex physical devices or large facilities. Specific information for each dataset is shown in Table 1.

[0047] Table 1. Attributes of the datasets used in the experiment

[0048] 5) Evaluation of results from public datasets The results of the proposed method and the comparative methods under the AUC metric are shown in Table 2. Bold text in the table indicates the highest average AUC and the best ranking. The anomaly detection method for multivariate electricity consumption data time series based on a hybrid anomaly expert driven by decoupled anomaly injection, proposed in this invention, is represented by TSMoAE in the table. The results in the table show that, under the AUC metric, TSMoAE achieved four best results across all five public datasets, with a significantly higher average score than other baseline methods, and achieved the best average ranking, indicating that TSMoAE's anomaly detection performance is superior to other comparative methods.

[0049] Table 2 Comparison of baseline method and TSMoAE under various metrics.

[0050] 6) Introduction to actual electricity consumption datasets The specific characteristics of the actual electricity consumption dataset (ELE) are shown in Table 3. This dataset was collected from 9 physical three-phase electricity meters in multiple distribution areas. Each device includes 22 sensor values: current (phase A, phase B, phase C), voltage (phase A, phase B, phase C), energy reading (positive active), energy reading (reverse active), energy reading (positive reactive), energy reading (reverse reactive), active power (phase A, phase B, phase C, total), reactive power (phase A, phase B, phase C, total), and power factor (phase A, phase B, phase C, total).

[0051] Table 3 Characteristics of Actual Electricity Consumption Data Set

[0052] 7) Evaluation of actual electricity consumption dataset results Table 4 shows the AUC results of the embodiments of the present invention and other comparative methods on a real-world electricity consumption dataset. The results show that, compared to all comparative methods, the TSMoAE proposed in this invention achieves the highest AUC score, indicating that its anomaly detection performance on the real-world electricity consumption dataset is superior to the comparative methods, demonstrating the reliability and superiority of TSMoAE in a real-world environment. Experimental results on both public datasets and real-world electricity consumption datasets demonstrate that the method proposed in this invention can effectively improve the accuracy of anomaly detection in electricity consumption data.

[0053] Table 4 Evaluation of Actual Electricity Consumption Data Set Results

[0054] Therefore, this invention proposes a two-stage unsupervised reconstruction-classification framework, TSMoAE, which integrates general anomaly knowledge and latent anomaly knowledge within the data domain. Based on a structured, decomposed time-frequency anomaly injection method and a latent space hybrid anomaly expert module, it fully utilizes both general anomaly knowledge and real latent anomaly knowledge within the data domain. The structured, decomposed time-frequency anomaly injection method injects different general anomaly patterns from the time-frequency domain only for continuous variable dimensions, generating more essential and diverse pseudo-anomaly samples. The latent space hybrid anomaly expert module is based on a step-by-step training strategy. It first uses a hard routing mechanism to train different experts to acquire specialized capabilities for different general anomaly patterns, and then combines latent anomaly knowledge within the data domain to train a dense gating network to explicitly simulate complex real anomalies. These designs and jointly optimized reconstruction-classification agent tasks enable TSMoAE to achieve robust training even under training data contamination conditions.

[0055] Exemplary device Figure 4 This is a schematic diagram of the structure of a power consumption data anomaly detection device based on decoupled anomaly injection driving provided in an exemplary embodiment of the present invention. Figure 4 As shown, the device 400 includes: The first generation module 410 is used to inject predefined pseudo-exceptions of various types into the normal data window and generate a pseudo-exception window. The second generation module 420 is used to pre-train the pre-built latent space hybrid anomaly expert network model architecture based on the normal data window and the pseudo-anomaly window, and generate the shared encoder, normal decoder, anomaly decoder and multiple anomaly expert networks of the latent space hybrid anomaly expert network model. The third generation module 430 is used to learn the routing network and classification head of the hybrid anomaly expert network based on multiple anomaly expert networks, including a shared encoder, a normal decoder, an anomaly decoder, and a hybrid anomaly expert network, to generate the routing network and classification network of the latent space hybrid anomaly expert network model. The calculation module 440 is used to calculate the reconstruction error of the test data at each time point and the anomaly probability output by the classification network based on the latent space hybrid anomaly expert network model, and obtain the point-by-point anomaly score by linear combination. The judgment module 450 is used to judge the point-by-point anomaly score according to the set threshold and obtain the anomaly detection result.

[0056] Exemplary electronic devices Figure 5 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. For example... Figure 5 As shown, the electronic device 50 includes one or more processors 51 and memory 52.

[0057] The processor 51 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0058] The memory 52 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 51 may execute the program instructions to implement the methods of the software programs of the various embodiments of the present invention described above, and / or other desired functions. In one example, the electronic device may also include an input device 53 and an output device 54, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0059] In addition, the input device 53 may also include, for example, a keyboard, a mouse, etc.

[0060] The output device 54 can output various information to the outside. The output device 54 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0061] Of course, for the sake of simplicity, Figure 5 Only some of the components of this electronic device relevant to the present invention are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0062] Exemplary computer program products and computer-readable storage media In addition to the methods and apparatus described above, embodiments of the present invention may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps of the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0063] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0064] Furthermore, embodiments of the present invention may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps of the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0065] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0066] The basic principles of the present invention have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in the present invention are merely examples and not limitations, and should not be considered as essential features of each embodiment of the present invention. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the present invention to the necessity of employing the aforementioned specific details.

[0067] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0068] The block diagrams of devices, systems, devices, and systems involved in this invention are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, systems, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0069] The methods and systems of the present invention may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of the present invention are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, the present invention may also be implemented as a program recorded on a recording medium, the program comprising machine-readable instructions for implementing the methods according to the present invention. Thus, the present invention also covers recording media storing programs for performing the methods according to the present invention.

[0070] It should also be noted that in the systems, apparatus, and methods of the present invention, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered equivalents of the present invention. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the invention. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the invention. Therefore, the invention is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0071] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the invention to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A method for detecting power consumption data anomalies based on decoupled anomaly injection driving, characterized in that, include: Inject predefined pseudo-exceptions of various types into the normal data window to generate a pseudo-exception window; The pre-built latent space hybrid anomaly expert network model architecture is pre-trained based on the normal data window and the pseudo-anomaly window to generate a shared encoder, normal decoder, anomaly decoder, and multiple anomaly expert networks of the latent space hybrid anomaly expert network model. Based on the shared encoder, normal decoder, abnormal decoder, and multiple abnormal expert networks of the hybrid abnormal expert network, the routing network and classification head of the hybrid abnormal expert network are learned to generate the routing network and classification network of the latent space hybrid abnormal expert network model. A latent space hybrid anomaly expert network model is adopted. Based on the sliding window, the reconstruction error of the test data at each time point and the anomaly probability output by the classification network are calculated, and the point-by-point anomaly score is obtained by linear combination. The point-by-point anomaly score is determined based on the set threshold to obtain the anomaly detection result.

2. The method according to claim 1, characterized in that, Injecting predefined pseudo-exceptions into the normal data window generates pseudo-exception windows, including: The normal data window is separated into continuous dimension variables and discrete dimension variables; The continuous-dimensional variable is subjected to trend-residual decomposition to obtain low-frequency trend components and high-frequency residual components; Multiple preset frequency domain anomaly injection operators are injected into the low-frequency trend component to apply frequency domain perturbation; Multiple preset time-domain anomaly injection operators are injected into the high-frequency residual components to apply time-domain perturbations; The perturbated low-frequency trend component and the high-frequency residual component are combined to obtain the abnormal continuous dimension. The abnormal continuous dimension is concatenated with the discrete dimension variable to form the pseudo-abnormal window.

3. The method according to claim 2, characterized in that, The various frequency domain anomaly injection operators include: Low-frequency amplitude scaling operator: in, For the first Trend components decomposed from continuous dimensions For random scaling factor, first random bandwidth , k The frequency after conversion to the frequency domain; These are preset hyperparameters; High-frequency truncation operator: Among them, random cutoff frequency ; Low-frequency amplitude averaging operator: Among them, the second random bandwidth ,parameter ; Low-frequency drift operator: Among them, the third random bandwidth Independent noise ; The various time-domain anomaly injection operators include: Spiral operator: in, For the first The residual components decomposed from each continuous dimension Indicates a random position. For random peak amplitude, Represents the impulse function; Flip operator: in, Represents a random segment; Speed ​​change operator: in, Represents the speed change factor, when When the time series is accelerated, the time series is accelerated, and vice versa. Slow down, Represents a random segment. ; Inversion operator: in, Represents a random segment; Noise-adding operator: in, Indicates the random channel scale. ,in iid Indicates independent and identically distributed, Let Variance be the variance.

4. The method according to claim 1, characterized in that, Pre-training is performed on the pre-constructed latent space hybrid anomaly expert network model architecture based on the normal data window and the pseudo-anomaly window, generating a shared encoder, normal decoder, anomaly decoder, and multiple anomaly expert networks of the latent space hybrid anomaly expert network model, including: The normal data window and the pseudo-abnormal window are encoded into latent variables using the shared encoder to obtain normal latent variables and abnormal latent variables; Based on the anomaly type label of the pseudo-anomaly window, the normal latent variable is input into the corresponding anomaly expert network in the latent space hybrid anomaly expert network model architecture through a hard routing distribution mechanism, and the anomaly expert network is trained to learn and generate the corresponding anomaly latent variable pattern with the anomaly latent variable as the target. The normal latent variables are input into the normal decoder for reconstruction, and the abnormal latent variables are input into the abnormal decoder for reconstruction. The reconstruction loss is calculated for each variable to constrain the shared encoder.

5. The method according to claim 1, characterized in that, Based on the shared encoder, normal decoder, abnormal decoder, and multiple abnormal expert networks of the hybrid abnormal expert network, the routing network and classification head of the hybrid abnormal expert network are learned to generate the routing network and classification network of the latent space hybrid abnormal expert network model, including: Using the shared encoder and the normal decoder, the reconstruction error and latent space density of each window in the training dataset are calculated; Based on the reconstruction error and the latent space density, pseudo-labels are assigned to each window using a quantile threshold strategy to distinguish normal windows, hard-to-learn normal windows, and potentially abnormal windows. Freeze the shared encoder and all the anomalous expert networks, input the normal latent variables corresponding to the normal window into the routing network, and generate mixed weights for each of the anomalous expert networks; Based on the hybrid weights, the outputs of each of the anomaly expert networks are combined to generate simulated anomaly latent variables; and with the latent variables corresponding to the potential anomaly window as a reference, the routing network and the classification network are trained by comparative loss. The simulated abnormal latent variables and the normal latent variables are input together into the classification network for training, and the normal decoder is fine-tuned using a window with pseudo-labeled normal variables.

6. The method according to claim 5, characterized in that, The contrastive loss function of the routing network L ctr The expression is: In the formula, This indicates the number of simulated anomalies generated. Indicates temperature. This indicates that the gradient has stopped. To simulate anomaly sets, Refers to normal latent variables and abnormal latent variables; The cross-entropy loss function of the classification network L cls The expression is: In the formula, The constructed classification training set, This indicates that the gradient has stopped. For classification networks, For normalized mapping functions, To simulate abnormal latent variables, Y n , Y a These are pseudo-labels for the data; The fine-tuning loss function of the normal decoder L r_n for: In the formula, X n This indicates a normal window. This indicates a normal window that has been refactored. X 0 , X 1 These represent the normal window and the difficult-to-learn normal window, respectively.

7. The method according to claim 1, characterized in that, The anomaly classification AS The calculation expression is: In the formula, The coefficients representing the anomaly probabilities output by the classification head of the classification network; Indicates the first Reconstruction error at each time point; Indicates the first The probability of anomalies at each time point.

8. A power consumption data anomaly detection device based on decoupled anomaly injection drive, characterized in that, include: The first generation module is used to inject predefined pseudo-exceptions of various types into the normal data window and generate a pseudo-exception window. The second generation module is used to pre-train the pre-built latent space hybrid anomaly expert network model architecture based on the normal data window and the pseudo-anomaly window, and generate a shared encoder, a normal decoder, an anomaly decoder, and multiple anomaly expert networks of the latent space hybrid anomaly expert network model. The third generation module is used to learn the routing network and classification head of the hybrid anomaly expert network based on the shared encoder, normal decoder, anomaly decoder and multiple anomaly expert networks of the hybrid anomaly expert network, and generate the routing network and classification network of the latent space hybrid anomaly expert network model. The calculation module is used to calculate the reconstruction error of the test data at each time point and the anomaly probability output by the classification network based on the latent space hybrid anomaly expert network model, and linearly combine them to obtain the point-by-point anomaly score. The judgment module is used to judge the point-by-point anomaly score according to the set threshold to obtain the anomaly detection result.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for performing the method described in any one of claims 1-7.

10. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1-7.

Images