Electricity stealing identification method and system based on multi-source data, electronic device and medium

Abstract

The present application relates to the technical field of power system monitoring, and more particularly to a power stealing identification method and system based on multi-source data, an electronic device and a medium; the method comprises: collecting operation data streams and local time stamps to obtain multiple sets of time series data sets; extracting electrical quantity mutation events or non-instruction switch action events in each set of time series data sets; based on the topological connection relationship of the power line and the Kirchhoff law and the law of conservation of energy, a multi-constraint model is constructed; the clock offset of each monitoring device relative to the system logical time is iteratively calculated; the node current imbalance and the loop power imbalance are solved by inversion to output the determination result of the power stealing event. In this way, the technical problem of circular dependence between event causal inference and time stamp calibration under the condition of multi-source asynchronous monitoring data in the prior art is solved, and the reliability, accuracy and automation level of power stealing behavior analysis are improved.

Description

Technical Field

[0001] This invention relates to the field of power system monitoring technology, and in particular to a method, system, electronic device and medium for identifying electricity theft based on multi-source data. Background Technology

[0002] With the deepening of smart grid construction and the widespread application of advanced metering infrastructure, power monitoring technology based on multi-source data has become an important development direction in the field of anti-electricity theft. The fusion analysis of multi-dimensional data such as current, voltage, power, and switch status provides richer criteria for accurately identifying abnormal electricity consumption behavior. Ideally, by comparing and analyzing data sequences from different monitoring points, it is theoretically possible to reconstruct the behavioral chain of electricity theft events, thereby achieving precise location and characterization. However, a long-standing and unresolved core logical challenge in this process is that the unreliability of the timestamps carried by each monitoring data point and the causal inference of events constitute an inescapable circular dependency dilemma, making it difficult for the system to establish a reliable time-series chain of abnormal behavior.

[0003] Specifically, to achieve accurate electricity theft detection, the system must accurately determine the causal relationship between key events (such as abnormal current fluctuations, unauthorized switch actions, and voltage anomalies), with the core basis being the true chronological order of events. However, establishing this temporal relationship relies entirely on the timestamps recorded by each data source. In actual large-scale, distributed deployment scenarios, due to multiple factors such as clock drift of monitoring equipment, communication network transmission delays, and asynchronous data acquisition cycles, timestamps from different monitoring nodes exhibit unknown and time-varying deviations. This puts the system in a logical dilemma: to determine the causal order of events, the timestamps of each data source must first be calibrated; however, calibrating the timestamps requires relying on a known and definite causal order as a benchmark. For example, when an indoor smart monitor records a person approaching the electrical box, a smart meter records a sudden drop in current, and a distribution terminal detects voltage fluctuations, if the sequence of events is determined directly based on the uncalibrated timestamps that may have deviations of several seconds or even longer, it is very easy to misjudge the sequence of electricity theft operations that should have a causal relationship as independent events or ordinary line interference, or even fail to draw a valid conclusion due to the contradiction in timing.

[0004] To improve identification accuracy, existing technologies have attempted to introduce multi-source data fusion analysis. Prior art document 1 (application publication number CN121208522A) discloses a method for identifying power facility operational anomalies using multi-source data fusion. This method constructs a tree-like power network topology, deploys monitors at each node to calculate the difference between actual and theoretical power consumption, and then locates abnormal sections layer by layer along the distribution path. Finally, it verifies the anomaly by combining video and infrared thermal imaging data. This method enhances the reliability of anomaly location by integrating electrical quantity analysis and visual data. However, its technical approach still relies on a crucial premise: that the power consumption data reported by each monitoring node and its corresponding timestamps are reliable and synchronized. This method fails to address and resolve the fundamental problem of inconsistent timestamps caused by asynchronous device clocks and communication delays. Essentially, it still relies on external clock synchronization protocols or assumes that the timestamps from each data source are absolutely reliable, failing to fundamentally resolve the timing logic dilemma caused by the unknown relative time difference between devices and the possibility of interference or falsification of the data source itself. Therefore, under the condition of multi-source asynchronous monitoring data, the existing technology faces the problem of circular dependency between "event causal inference" and "timestamp calibration" caused by the unknown deviation of the device timestamp. Summary of the Invention

[0005] To address the aforementioned shortcomings or drawbacks, this invention provides a method, system, electronic device, and medium for identifying electricity theft based on multi-source data. This solution addresses the technical problem of circular dependence between event causal inference and timestamp calibration in existing technologies under multi-source asynchronous monitoring data conditions.

[0006] This invention provides a method for identifying electricity theft based on multi-source data, comprising:

[0007] The system collects operational data streams and local timestamps corresponding to each data point from multiple monitoring devices deployed on the same power line during the same time period, and establishes a mapping relationship between operational data points and timestamps for each monitoring device to obtain multiple sets of time series datasets.

[0008] Anomaly detection is performed on each time series dataset, and electrical quantity mutation events or non-command switching action events exceeding preset thresholds are extracted from each time series dataset.

[0009] Based on the topological connections of power lines and Kirchhoff's laws and the law of conservation of energy, a multi-constraint model is constructed. The multi-constraint model is used to describe the causal temporal relationships and electrical quantity coupling relationships between events at different monitoring points.

[0010] Using the local timestamps recorded by each monitoring device as the observation and a multi-constraint model as the intrinsic benchmark, the clock offset of each monitoring device relative to the system logic time is iteratively calculated by solving the optimization problem.

[0011] By using clock offset to compensate for the deviation and align the timestamps of all events, a globally consistent event timing log is generated. Based on this event timing log, the node current imbalance and loop power imbalance are inverted and solved.

[0012] Time-domain features are extracted from node current imbalance and circuit power imbalance. The extracted time-domain features are correlated with the switching event sequence. Based on the analysis results, the judgment result of the electricity theft event is output according to the preset judgment logic.

[0013] According to a second aspect, the present invention provides a multi-source data-based electricity theft detection system, comprising:

[0014] The time series dataset construction module is used to collect the operation data streams reported by multiple monitoring devices deployed on the same power line during the same time period and the local timestamps corresponding to each data point, and to establish a mapping relationship between operation data points and timestamps for each monitoring device, thereby obtaining multiple sets of time series datasets.

[0015] The abnormal event extraction module is used to detect anomalies in each group of time series datasets and extract electrical quantity mutation events or non-command switching action events that exceed preset thresholds in each group of time series datasets.

[0016] The multi-constraint model construction module is used to construct multi-constraint models based on the topological connection relationship of power lines and Kirchhoff's laws and the law of conservation of energy. The multi-constraint model is used to describe the causal time sequence relationship and electrical quantity coupling relationship between events at different monitoring points.

[0017] The clock offset calculation module is used to calculate the clock offset of each monitoring device relative to the system logic time by solving optimization problems, using the local timestamps recorded by each monitoring device as the observation and a multi-constraint model as the internal benchmark.

[0018] The imbalance calculation module is used to compensate for the deviation and align the timestamps of all events using clock offset, generate a globally consistent event timing log, and solve the node current imbalance and loop power imbalance based on the event timing log.

[0019] The electricity theft identification result output module is used to extract time-domain features of node current imbalance and circuit power imbalance, perform correlation analysis between the extracted time-domain features and the switch event sequence, and output the judgment result of the electricity theft event based on the analysis results and preset judgment logic.

[0020] According to a third aspect, the present invention provides an electronic device comprising:

[0021] At least one processor; and a memory communicatively connected to the at least one processor;

[0022] The memory stores instructions that can be executed by the at least one processor, which enables the at least one processor to execute any of the multi-source data-based electricity theft identification methods in the embodiments of the present invention.

[0023] According to another aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute any of the electricity theft identification methods based on multi-source data in the embodiments of the present invention.

[0024] The present invention provides a method for identifying electricity theft based on multi-source data. This method is achieved through six core steps: data acquisition and organization, abnormal event extraction, physical constraint modeling, time parameter solving, electrical parameter inversion, and feature recognition and decision-making. Specifically, it collects operational data streams and their local timestamps from multiple monitoring devices deployed on the same power line, and establishes a mapping relationship between data points and timestamps for each device, thus organizing heterogeneous and asynchronous raw monitoring data into a unified analytical basis. It performs anomaly detection on each time series dataset and extracts events exceeding a preset threshold to locate key abnormal states from massive amounts of data. Based on the power line topology and Kirchhoff's laws and the law of conservation of energy, a multi-constraint model is constructed to describe the causal time sequence and electrical quantity numerical relationships that should be satisfied between events at different monitoring points. The local timestamps of each device are used as observations, and the multi-constraint model is used as the... An intrinsic benchmark is used to iteratively calculate the clock offset of each device by solving an optimization problem, which is used to quantitatively calibrate unknown time deviations between devices. The clock offset is used to compensate for the deviation and align the timestamps of all event records, generating a globally consistent event time sequence log. Based on this time sequence log, the node current imbalance and loop power imbalance are inverted and solved to parse the essential electrical parameters characterizing the abnormal flow of unmonitored power. The time-domain features of the imbalance are extracted and correlated with the switch event sequence. The judgment result is output according to the preset judgment logic to achieve accurate identification and judgment of electricity theft.

[0025] In this technical solution, the present invention addresses the core technical problem of the circular dependency between event causal inference and timestamp calibration, as described in the background technology. It introduces a set of physical relationship constraints based on topological connectivity, Kirchhoff's laws, and the law of conservation of energy as an intrinsic benchmark. The local timestamps recorded by each monitoring device are used as observations, and the clock offset is iteratively calculated by solving an optimization problem. This technique fundamentally breaks the logical loop of "needing to calibrate timestamps to determine causality, and then needing to know the causality to calibrate the timestamps," achieving autonomous time synchronization without relying on an external absolute clock under multi-source asynchronous data conditions. Subsequently, by using the calibrated globally consistent event time-series log for inversion and solution, the node current imbalance and loop power imbalance can be accurately analyzed, providing direct and reliable electrical quantity evidence for electricity theft identification. Therefore, the technical solution of this invention solves the technical problem of the circular dependency between event causal inference and timestamp calibration under multi-source asynchronous monitoring data conditions in existing technologies, improving the reliability, accuracy, and automation level of electricity theft behavior analysis. Attached Figure Description

[0026] Figure 1 This is a flowchart of an embodiment of the electricity theft identification method based on multi-source data according to the present invention;

[0027] Figure 2 This is a complete logical diagram illustrating the electricity theft identification and processing flow based on multi-source data and physical constraints according to another embodiment of the present invention.

[0028] Figure 3 This is a schematic diagram of the structure of an electricity theft identification system based on multi-source data according to an embodiment of the present invention;

[0029] Figure 4 This is a block diagram of an electronic device used to implement embodiments of the present invention. Detailed Implementation

[0030] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0031] During the development of this invention, the inventors, through extensive experiments and data analysis, discovered an intrinsic correlation between the timestamp system deviation of multi-source monitoring data and the inherent physical constraints of power lines (Kirchhoff's Current Law and the Law of Conservation of Energy): Under a unified physical time reference, the current, voltage, and power measurements at each monitoring point in the same power line must strictly adhere to the node current conservation and loop power balance relationships determined by the line topology; simultaneously, the propagation of electrical signals and the response of switching operations must also follow a definite causal timing sequence. These physical laws provide an absolutely reliable intrinsic reference for cross-device data alignment that does not depend on an external clock. Based on this relationship, the inventors innovatively proposed this technical solution, utilizing the topological connection relationship of power lines and basic circuit laws, by constructing a multi-constraint model describing the causal timing sequence and electrical quantity coupling relationship between events, combining the local timestamp observations recorded by each monitoring device, and iteratively calculating the clock offset by solving an optimization problem, thereby achieving autonomous calibration of multi-source data timing and accurate analysis of electrical parameters characteristic of electricity theft without the need for external time synchronization. This embodies the core concept of "using physical laws as an intrinsic reference to break the circular dependency between time synchronization and event causal inference."

[0032] Specifically, through comparative experiments, the invention team discovered that traditional methods relying on external clock synchronization or assuming absolute reliability of timestamps have fundamental logical flaws: when there is unknown clock drift or communication delay in the device, the event sequence determined based on uncalibrated timestamps is extremely unreliable, making it impossible to accurately establish the causal chain of electricity theft, resulting in misjudgments or omissions. However, the time-series self-calibration method proposed in this invention, based on physical constraints as an intrinsic benchmark, can improve the autonomy and reliability of time alignment for multi-source heterogeneous data; by introducing globally consistent event time-series logs, it can accurately invert and solve key electrical characteristics of electricity theft (node ​​current imbalance, loop power imbalance); by extracting time-domain features from abnormal electrical parameters and correlating them with switch event sequences, it can ensure the objectivity and intelligence of electricity theft determination; and by automatically outputting the determination results through preset decision logic, it can achieve a fully automated closed-loop electricity theft monitoring process, while significantly reducing reliance on manual experience analysis and improving identification efficiency and accuracy.

[0033] Therefore, this invention provides a method for identifying electricity theft based on multi-source data, according to the first aspect. This method can be applied to an electricity theft identification system based on multi-source data (hereinafter referred to as the "system"). The system can run on electronic devices with data processing capabilities via software or firmware to complete the acquisition of multi-source asynchronous monitoring data, time self-calibration, abnormal electrical parameter inversion, and intelligent identification of electricity theft events. Specifically, this system can be deployed in various hardware environments, including but not limited to: cloud data center servers of power companies, edge computing gateways in substations or distribution rooms, and intelligent monitoring terminals integrating computing units. This flexible deployment architecture allows the system to meet both the needs of centralized, in-depth analysis of wide-area, multi-line monitoring data and the requirements of distributed, real-time analysis of critical lines at the monitoring site.

[0034] like Figure 1 As shown, the method may include:

[0035] Step S110: Collect the operation data streams reported by multiple monitoring devices deployed on the same power line during the same time period and the local timestamps corresponding to each data point, and establish a mapping relationship between operation data points and timestamps for each monitoring device to obtain multiple sets of time series datasets.

[0036] Among them, the operation data stream refers to the raw data sequence continuously reported by each monitoring device, which contains various electrical quantities and status quantities; the local timestamp refers to the local time mark of the data point generation time recorded by the clock system of each monitoring device; the time series dataset refers to the structured data set formed by arranging and associating the operation data points belonging to the same monitoring device according to the order of their corresponding local timestamps.

[0037] Specifically, the system can use the data acquisition module to call preset communication protocol interfaces (such as MQTT and IEC 104) to pull or receive historical and real-time data within the subscribed period from multiple selected monitoring devices, and parse the data packets to extract the measurement values ​​and corresponding timestamps. MQTT (Message Queuing Telemetry Transport) is a lightweight, publish / subscribe-based message transmission protocol designed for low-bandwidth, high-latency, or unreliable network environments. IEC 104 is a communication protocol standard (full name IEC 60870-5-104) developed by the International Electrotechnical Commission (IEC) for power system monitoring.

[0038] For example, the system uses a 10 kV distribution feeder as the monitoring object, selecting three monitoring devices at the feeder's head end, middle branch point, and end user location. A unified monitoring period is set from 10:00:00 to 10:10:00 on October 1, 2023, a total of 10 minutes. The data acquisition module collects approximately 18,000 valid data points from these three devices, including current, voltage, power, and switch status. Each data point is associated with its device source and timestamp, ultimately forming three corresponding time-series datasets.

[0039] Step S120: Perform anomaly detection on each group of time series datasets and extract electrical quantity mutation events or non-command switching action events that exceed the preset threshold in each group of time series datasets.

[0040] Among them, anomaly detection refers to the calculation process of automatically identifying data segments in a data sequence that deviate from the normal pattern or range through algorithms; electrical quantity mutation events specifically refer to drastic changes in electrical measurement values ​​such as current, voltage, or power that exceed the normal fluctuation range within a very short period of time; non-command switching action events specifically refer to changes in the state of switching equipment (such as closed / open) without receiving any legitimate control commands (including remote scheduling commands and local authorized operations).

[0041] Specifically, the system can use the event extraction module to set dynamic anomaly judgment thresholds for current, voltage, and power, and use a sliding time window algorithm to traverse and calculate each time series dataset. When the calculated change or deviation exceeds the corresponding threshold, the moment and event type are recorded. At the same time, the module continuously compares the switch state changes with the instruction log and records state switches without matching instructions as events.

[0042] For example, for a current data sequence from a user branch monitoring point, the event extraction module continuously calculates the current change rate with a 1-second calculation window. When it is detected that at 10:00:05, the current value drops from 50 amperes (A) to 5A within 0.1 seconds, a change of 45A exceeding the preset 30A sudden change threshold, the system records a "current sudden change event" reported by that device at that moment. Simultaneously, another device reports a record of a switch state changing from "closed" to "open" at 10:00:04, but there are no corresponding operation commands in the command log within 5 minutes before and after, the system records a "switch non-command action event".

[0043] Step S130: Based on the topological connection relationship of power lines and Kirchhoff's laws and the law of conservation of energy, construct a multi-constraint model.

[0044] Among them, the multi-constraint model is used to describe the causal temporal relationship and electrical quantity coupling relationship between events at different monitoring points. Specifically, it refers to a set of multiple mathematical constraints that enforce the quantitative relationship that must be satisfied between the events reported by monitoring devices at different locations and the electrical measurement values ​​under the correct physical time reference.

[0045] Specifically, the system can first load a digital topology map of the target power line through the constraint modeling module to determine the specific access node of each monitoring device in the map; then, it can automatically generate four types of basic constraints based on circuit theory:

[0046] (1) For any topology node, the algebraic sum of the measured currents of all devices connected to the node is zero (node ​​current constraint).

[0047] (2) When an electrical disturbance signal propagates along the line, the upstream monitoring point must record the event earlier than the downstream monitoring point (signal propagation constraint).

[0048] (3) For any closed power supply circuit, the total input power is equal to the sum of the power consumed by each load and the power lost by the line (circuit power constraint).

[0049] (4) The recording time of the switch action event must be earlier than the recording time of the electrical quantity abnormality event directly caused by the action (operational causal constraint).

[0050] For example, the topology of the aforementioned 10kV feeder is "substation outgoing line - main line - branch 1 - branch 2". Based on this topology, the constraint modeling module automatically establishes constraints for monitoring device A at the outgoing line, device B at branch 1, and device C at branch 2. For instance, it establishes a node current constraint for node "branch 1": the current measured by device B + the theoretical current flowing downstream = 0; simultaneously, it establishes a signal propagation constraint: the time of event recorded by device A + the signal transmission delay < the time of the corresponding event recorded by device B.

[0051] Step S140: Using the local timestamps recorded by each monitoring device as the observation and the multi-constraint model as the intrinsic benchmark, the clock offset of each monitoring device relative to the system logic time is iteratively calculated by solving the optimization problem.

[0052] In optimization theory, observations refer to known input data or measured values; system logic time is a unified virtual time base defined for the entire analysis system and does not correspond to the clock of a particular physical device; clock offset is defined as the difference between the time indicated by the local clock of a monitoring device and the system logic time, in seconds (s).

[0053] Specifically, the system can introduce an unknown clock offset as an optimization variable for each monitoring device through a timing calibration module; use the local timestamps of all events extracted in step S120 as known observations; use the multi-constraint model constructed in step S130 (the constraints need to be transformed into equations or inequalities containing clock offsets) as the physical rules that must be satisfied; construct an optimization problem (usually transformed into a least squares problem) with all clock offsets as unknowns and minimizing the degree of violation of all constraint equations as the objective; and use a numerical iterative algorithm (such as the Levenberg-Marquardt algorithm) to solve it.

[0054] For example, for devices A, B, and C, the timing calibration module defines an offset. It utilizes the extracted timestamps of "current surge events". and "switch action event" timestamp And signal propagation constraints (such as the theoretical delay of a signal from A to B is...) Establish the equation: Similarly, by combining other constraints, a system of equations is formed. Through iterative solving, a solution is finally obtained: Second, Second, This indicates that device A's local clock is 1.2 seconds ahead of the system logical time, and device B's clock is 0.8 seconds behind.

[0055] Step S150: Use the clock offset to compensate for the deviation and align the timestamps of all events to generate a globally consistent event timing log, and use the event timing log to invert and solve for the node current imbalance and loop power imbalance.

[0056] Among them, deviation compensation refers to adding (or subtracting) the clock offset of the corresponding device to the original local timestamp of an event; time alignment refers to sorting all events after deviation compensation on a unified system logical time axis; a globally consistent event timing log is a list containing all events and their attributes arranged in the corrected physical time order; node current imbalance refers to the difference between the algebraic sum of currents measured by all monitoring devices at a certain topology node and zero, according to Kirchhoff's current law, which represents possible but unmonitored current injection or loss; loop power imbalance refers to the difference between the total input power and the total output power (including losses) in a certain power supply closed loop, according to the law of conservation of energy, which represents possible but unmetered power loss.

[0057] Specifically, the system can use the anomaly analysis module to first calculate the corrected physical time for each event extracted in step S120 by applying the clock offset of the corresponding device obtained in step S140. Then, for all events... The data is sorted to generate a time-series log. Next, a key physical moment (such as a period of concurrent occurrence of multiple abnormal events) is selected from the time-series log, and the precise current, voltage, and power values ​​of each monitoring point at that moment are interpolated from the raw data. Finally, the current and power values ​​of each monitoring point are substituted into the node current balance equation and loop power balance equation established based on the topology. The unbalanced quantities in the equations are treated as unknowns, and the specific values ​​of these unbalanced quantities are obtained by solving a system of linear equations.

[0058] For example, the original timestamp of the "current surge event" reported by device B is 10:00:05, with an offset of for Seconds, corrected time The time is 10:00:04.2. The corrected time for the "switch action event" reported by device C is 10:00:04.5. After sorting, the switch action precedes the current surge. The system selects the time T0 = 10:00:04.5, and interpolates to find that the input power of device A is 220 kW and the output power of device B is 110 kW. Assuming that this circuit has only these two monitoring points, the power balance equation is established as follows: The circuit power imbalance is obtained by solving. kW. Simultaneously, a current balance equation is established at node "branch 1", and the node current imbalance is obtained by solving it. A.

[0059] Step S160: Extract time-domain features from node current imbalance and loop power imbalance, perform correlation analysis between the extracted time-domain features and switch event sequence, and output the determination result of electricity theft event based on the analysis results and preset judgment logic.

[0060] Among them, time-domain feature extraction refers to the process of calculating numerical indicators that can characterize the statistical characteristics or regularity of signals or sequences that change over time; correlation analysis refers to mathematical methods for calculating the degree of correlation or synchronicity between two or more time series; and pre-defined decision logic is a series of judgment processes based on "if-then" rules or machine learning models, used to map the feature analysis results to the final classification decision (such as "electricity theft" or "normal").

[0061] Specifically, the system can use the electricity theft detection module to calculate three characteristics for the unbalanced current sequence of each node and the unbalanced power sequence of each loop within a set analysis time window (e.g., the past 30 minutes):

[0062] (1) The arithmetic mean of the sequence (reflecting the average level of outliers);

[0063] (2) Standard deviation of the sequence (reflecting the stability of fluctuations in outliers);

[0064] (3) The peak value of the cross-correlation function between the sequence and the non-command action event sequence of the switch (reflecting the correlation strength between the anomaly and the switch operation). Then, the module compares these three feature values ​​of each node or loop with preset thresholds. When both conditions are met, the module will determine the value of the feature value. "Standard deviation less than threshold" "Association strength greater than the threshold" If the condition is met, it is determined that an electricity theft event has occurred at that node or circuit, and a determination report containing the location, time, and anomaly type is generated.

[0065] For example, for node "branch 1", the system calculates its current imbalance sequence over the past 30 minutes and obtains the mean. Standard deviation Correlation with the sequence of switching events Preset threshold .because Furthermore, 0.85 > 0.7. With all three conditions met, the electricity theft detection module finally outputs the following result: "A continuous, stable current loss that is highly correlated with illegal switching operations was detected at node 1 of branch, which is determined to be an electricity theft event."

[0066] In other embodiments, such as Figure 2 This presentation showcases a complete logical diagram of an electricity theft identification and processing workflow based on multi-source data and physical constraints. The workflow, employing a loop and conditional judgment structure, clearly depicts the decision-making path from data input to result output, and particularly highlights the differentiated processing logic for the core issue of "whether the timestamp is reliable."

[0067] Taking a specific power distribution community as an example: The system first acquires current, voltage, and switch status data streams and their local timestamps from five monitoring devices located at the community's incoming line, key branch nodes, and some user meter boxes. Next, the system performs real-time data analysis to determine if any abnormal events have been detected. For example, the system detects a sudden current change (from 5A to 50A) at user A's meter box within a short timeframe, while a power deviation (a sudden increase of 10kW) is detected at the community's main incoming line, with no corresponding operational instructions from the background. Since these abnormal events have been detected, the process enters the "yes" branch. Subsequently, based on the community's single-radial distribution topology and circuit laws, the system automatically establishes a set of physical relationship constraints, including: node current constraints where the incoming line current equals the sum of the branch currents; propagation constraints on the time required for electrical signals to travel from the incoming line to user A; and loop power constraints where the total input power equals the sum of the load power. The process then faces a critical decision point: determining if a time deviation exists. The system uses these physical constraints to verify the consistency of the timestamps of the events reported by each device. Assume that, based on signal propagation speed, the current surge at User A should theoretically be at least 20 milliseconds (ms) later than the total incoming power surge, but in the actual data, User A's timestamp is earlier. This contradiction indicates a time discrepancy between devices, and the process enters the "yes" branch. The system then solves for the time discrepancy parameter. Based on the aforementioned physical constraints, an optimization algorithm calculates the offset of each device's clock relative to the system's logical time. For example, the clock of User A's monitoring device is found to be approximately 2.1 seconds fast. Using the solved discrepancy parameter, the system corrects the event timing for all recorded timestamps, subtracting 2.1 seconds from the timestamp of User A's current surge event, thus obtaining a globally logically consistent event sequence: the total incoming power surge occurs first, followed by User A's current surge, consistent with physical propagation laws. Based on the corrected timing, the system again applies physical constraints to solve for abnormal electrical parameters. At this point, at the corrected "current surge of User A," the nodal current constraint equations are solved, revealing a persistent nodal current imbalance of approximately 45A at the node where User A is located. This imbalance is highly spatiotemporally correlated with an unauthorized "non-command switch action event." Finally, the system performs feature analysis on the calculated current imbalance sequence to determine if electricity theft has been detected. Since the imbalance has a significant mean, small fluctuations, and a strong correlation with illegal switch operations, it meets all preset electricity theft identification criteria. The process then proceeds to the final "Yes" branch, outputting the judgment that "User A has engaged in electricity theft," and ends the analysis process.

[0068] Figure 2The flowchart also illustrates another path: if, in the "determine if there is a time deviation" step, all event timings are verified to conform to physical constraints, it indicates that the timestamps of each device are basically reliable, and the system will enter the "no" branch to directly solve for abnormal electrical parameters, thereby simplifying the process and improving processing efficiency. This flowchart, through structured logical judgments, fully demonstrates the core idea and closed-loop steps of the present invention's adaptive processing of device time synchronization problems.

[0069] In summary, based on the above implementation method, the system achieves its functionality through six core steps: data acquisition and organization, anomaly event extraction, physical constraint modeling, time parameter solving, electrical parameter inversion, and feature recognition and decision-making. Specifically, it collects operational data streams and their local timestamps from multiple monitoring devices deployed on the same power line, establishing a mapping relationship between data points and timestamps for each device. This is used to organize heterogeneous and asynchronous raw monitoring data into a unified analytical foundation. Anomaly detection is performed on each time series dataset, and events exceeding preset thresholds are extracted to locate key anomalies from massive amounts of data. A multi-constraint model is constructed based on the power line topology and Kirchhoff's laws and the law of conservation of energy to describe the causal time sequence and electrical quantity numerical relationships that should be satisfied between events at different monitoring points. The local timestamps of each device are used as observations, and the multi-constraint model serves as the basis for analysis. An intrinsic benchmark is used to iteratively calculate the clock offset of each device by solving an optimization problem, which is used to quantitatively calibrate unknown time deviations between devices. The clock offset is used to compensate for the deviation and align the timestamps of all event records, generating a globally consistent event time sequence log. Based on this time sequence log, the node current imbalance and loop power imbalance are inverted and solved to parse the essential electrical parameters characterizing the abnormal flow of unmonitored power. The time-domain features of the imbalance are extracted and correlated with the switch event sequence. The judgment result is output according to the preset judgment logic to achieve accurate identification and judgment of electricity theft.

[0070] Specifically, in this embodiment, addressing the core technical problem of the circular dependency between event causal inference and timestamp calibration as described in the background technology, a set of physical relationship constraints based on topological connectivity, Kirchhoff's laws, and the law of conservation of energy is introduced as an intrinsic benchmark. The local timestamps recorded by each monitoring device are used as observations, and the clock offset is iteratively calculated by solving an optimization problem. This technique fundamentally breaks the logical loop of "needing to calibrate timestamps to determine causality, and then needing to know the causality to calibrate the timestamps," achieving autonomous time synchronization without relying on an external absolute clock under multi-source asynchronous data conditions. Subsequently, by using the calibrated globally consistent event time-series log for inversion and solution, the node current imbalance and loop power imbalance can be accurately analyzed, providing direct and reliable electrical quantity evidence for electricity theft identification. Therefore, the technical solution of this embodiment solves the technical problem of the circular dependency between event causal inference and timestamp calibration under multi-source asynchronous monitoring data conditions in the prior art, improving the reliability, accuracy, and automation level of electricity theft behavior analysis.

[0071] In some embodiments, each set of time series datasets includes corresponding current data sequences, voltage data sequences, power data sequences, and switch state sequences; anomaly detection is performed on each set of time series datasets to extract electrical quantity mutation events or non-command switching action events exceeding a preset threshold in each set of time series datasets, including:

[0072] Continuous analysis of current data sequences is performed to extract events in which the change in current value within a unit of time exceeds the current anomaly judgment threshold, which are denoted as current mutation events.

[0073] Among them, the change per unit time refers to the absolute value of the difference between the final value and the initial value of the current measurement or the rate of change within a set, short time window (such as 0.1 seconds or 1 second); the current anomaly judgment threshold is a numerical threshold set comprehensively based on the line's rated current carrying capacity, historical normal operating fluctuation range and protection settings, used to distinguish between normal load fluctuations and abnormal sudden changes caused by suspected electricity theft or faults.

[0074] Specifically, the system can use an event extraction module to perform real-time traversal of the current data sequence using a sliding time window algorithm. For each time window, the difference between the start and end times within the window is calculated, and the absolute value of this difference is compared with a preset current anomaly judgment threshold. If the threshold is exceeded, the end time of the window is recorded as the occurrence time of a current surge event, and event attributes (such as device identifier and surge amplitude) are saved. For example, for a residential user's incoming line with a rated current of 200 amperes (A), the system sets the current anomaly judgment threshold to 150A and the time window length to 0.1 seconds. When the current value reported by the user's meter is 5A at time t1, and suddenly increases to 160A at t1+0.1 seconds, the calculated change is 155A, exceeding the 150A threshold. The system then records a current surge event occurring at t1+0.1 seconds.

[0075] Continuous analysis of voltage data sequences is performed to extract events in which the voltage value deviates from the rated range and the duration reaches the voltage anomaly judgment threshold, which are recorded as voltage anomaly fluctuation events.

[0076] The rated range refers to the allowable deviation range of the supply voltage specified in the power system regulations. For example, for 220V residential electricity, the rated range may be 198V to 235V. The duration refers to the total duration for which the voltage measurement value is continuously outside the rated range. The voltage anomaly judgment threshold is a time threshold (such as 2 seconds or 5 seconds) set for the duration to filter out brief, harmless voltage disturbances.

[0077] Specifically, the system can continuously monitor each sampling point of the voltage data sequence through the event extraction module. When a voltage value is detected to be outside the rated range, a timer is started. The timer accumulates time as long as the voltage value remains outside the range. Once the voltage value returns to the rated range, the timer is reset to zero. If the accumulated time reaches or exceeds a preset voltage anomaly judgment threshold, a voltage anomaly fluctuation event is determined to have occurred, and the time when the event started exceeding the limit is recorded as the event occurrence time. For example, the system monitors that the outlet voltage of a transformer in a certain area starts to drop to 195V (below the rated lower limit of 198V) at 10:05:00 and remains below 198V until it recovers at 10:05:06. The system's set voltage anomaly judgment threshold is 5 seconds. Since the duration of the out-of-limit event is 6 seconds, which is greater than the 5-second threshold, the system records a voltage anomaly fluctuation event that started at 10:05:00.

[0078] Continuous analysis of power data sequences is performed to extract events where the difference between the power value and the normal load power benchmark value exceeds the power anomaly judgment threshold, which are recorded as power deviation events.

[0079] The normal load power benchmark value refers to the expected power value of the monitoring point in the same period in history or calculated by the load prediction model under similar time periods (such as daytime on a weekday) and similar weather conditions; the power anomaly judgment threshold is an allowable deviation range relative to the benchmark value, usually expressed as a percentage (such as ±30%) of the benchmark value or a fixed difference.

[0080] Specifically, the system can use the event extraction module to first generate the normal load power baseline value of the monitoring point for the current time period based on historical data or prediction algorithms. Subsequently, the real-time power measurement values ​​will be... Compare with the benchmark value and calculate the absolute difference. .like Exceeding the preset power anomaly detection threshold If so, the current moment is recorded as a power deviation event. For example, for a commercial complex, based on historical data, its typical power reference value at 10:00 AM on a weekday is... The power rating is 500 kilowatts (kW). The system is set with a power anomaly detection threshold. This is 40% of the baseline value, or 200kW. If the instantaneous power is monitored at 10:05 AM on a certain morning... If it reaches 800kW, then If the power exceeds the 200kW threshold, the system records a power deviation event.

[0081] Real-time monitoring of the switch state sequence is performed, and events in which state switching occurs when no valid remote or local operation command is issued are extracted and recorded as switch non-command action events.

[0082] Among them, a legitimate remote operation command refers to a remote opening and closing command that has been securely certified and issued through a power dispatch automation system (such as SCADA, which stands for Supervisory Control and Data Acquisition) or a distribution network management system; a legitimate local operation command refers to an operation performed on-site by an authorized electrical worker using special tools or authorized buttons; and a state switch refers to a switchgear changing from a "closed" state to an "open" state, or from an "open" state to a "closed" state.

[0083] Specifically, the system can use the event extraction module to receive switch status change signals from monitoring devices and operation instruction logs from the scheduling instruction library and the operation ticket system in parallel. Whenever a switch status sequence is detected to transition from state A to state B, the system immediately checks the instruction log for a valid remote or local operation instruction for that switch within a reasonable time window (e.g., 2 minutes) before and after the status change. If the query result shows no matching valid instruction, the system determines that the status change is a non-instructional action and records it as a switch non-instructional action event. For example, the system detects that the pole-mounted switch numbered "SW-101" changes its status from "closed" to "open" at 14:30:25. The event extraction module then searches the instruction library for all operation records related to "SW-101" between 14:28:25 and 14:32:25, finding no remote control or authorized on-site operation tickets. Therefore, the system determines this action is a non-instructional action and records it as a switch non-instructional action event.

[0084] Therefore, according to the above implementation method, the system can comprehensively and automatically capture key events in the power line that may represent electricity theft or equipment abnormality from four dimensions: current, voltage, power and switch status, providing accurate and multi-dimensional raw event input for subsequent time-series analysis and electricity theft determination based on physical constraints.

[0085] In some embodiments, a multi-constraint model is constructed based on the topological connections of power lines and Kirchhoff's laws and the law of conservation of energy, including:

[0086] Based on the topological connection relationship of power lines, the monitoring points of each monitoring device in the topological connection relationship are determined.

[0087] The monitoring point refers to the specific connection location of the monitoring equipment in the power network topology diagram. This location determines which topology node or line segment the electrical quantities (such as current and voltage) measured by the equipment belong to.

[0088] Specifically, the system can use the topology parsing module to load a topology map file (such as CIM / E format, a widely used power system data exchange format based on the Common Information Model / Energy) that describes the connection relationships of power lines. This file defines all electrical equipment (such as transformers, circuit breakers, and loads) and their connections. Based on the unique identifier (such as asset ID) of each monitoring device, the module searches for the corresponding electrical device in the topology map and defines the topology node or line endpoint where that device is located as the monitoring point of that device. For example, for a simple tree-like distribution network, the topology parsing module determines that the monitoring point of monitoring device A installed at the main incoming line of the distribution box is "node N1", the monitoring point of monitoring device B installed at user branch 1 is "node N2", and the monitoring point of monitoring device C installed at user branch 2 is "node N3".

[0089] Based on Kirchhoff's current law, node current constraints are established to ensure that the algebraic sum of the currents flowing into and out of any topological node is zero.

[0090] The algebraic sum of currents being zero means that at any given moment, the sum of all currents flowing into a topological node is equal to the sum of all currents flowing out of that node. This is a fundamental law in circuit theory, reflecting the principle of charge conservation.

[0091] Specifically, the system can traverse every node in the topology graph through a constraint generation module. For each node, the module finds all lines connected to that node and identifies the monitoring devices installed on these lines. Then, it generates a mathematical constraint equation for that node: summing the current measurements (positive for inflow, negative for outflow) reported by all monitoring devices at the same time (time-calibrated), the sum should be zero (allowing for a very small tolerance error caused by measurement error and unmonitored minor loads). For example, for node N2, suppose there is a monitoring device A (located upstream, measuring the current flowing into N2). ) and monitoring device B (located in the downstream branch, measuring the current flowing out of N2). The resulting node current constraint equations are: ,Right now If there is another small load branch without installed monitoring equipment, the equation allows for a small deviation, i.e. .

[0092] Establish signal propagation constraints, which are used to limit the time when an event is recorded by a monitoring point upstream of the signal propagation path to be earlier than the time when the corresponding event is recorded by a monitoring point downstream.

[0093] Among them, the signal propagation path refers to the physical path of electrical disturbances (such as short-circuit current, surges caused by switching operations) propagating in the power line; the corresponding event refers to the same type of abnormal electrical quantity event (such as current change) triggered and detected at different monitoring points by the same source disturbance.

[0094] Specifically, the system can use a constraint generation module to determine the possible propagation direction of power flow or signals based on topological connections. For any two monitoring points with a direct upstream-downstream relationship (e.g., point M is upstream of point N), this module generates a time-series inequality constraint regarding the event recording time: .in, and These are the timestamps (recorded by their respective device clocks) of the same disturbance event recorded by upstream monitoring point M and downstream monitoring point N. This is the shortest time required for a signal to propagate between two monitoring points (estimated based on line length and signal propagation speed). For example, if the line length between monitoring points M and N is 5 kilometers (km), and the speed of electromagnetic waves in a power line is approximately 2 / 3 the speed of light, that is, [time per second is missing from the original text]. Kilometers (km / s). Then the shortest signal propagation time. seconds (s) or 25 microseconds ( Therefore, the generated constraints are: .

[0095] The loop power constraint is established based on the law of conservation of energy. The loop power constraint is used to limit the total input power in any power supply closed loop to be equal to the sum of the load power consumption and the line loss power.

[0096] In this context, a closed-loop power supply circuit refers to a closed electrical path in the power grid topology that starts from the power source point, passes through lines and loads, and then returns to the same power source point.

[0097] Specifically, the system can identify one or more closed power supply loops in the topology map through a constraint generation module. For a selected loop, the module locates all power injection points (such as substation outlets) and load points in the loop, and obtains the power values ​​reported by the corresponding monitoring equipment (input power is positive, and output power is considered negative due to load consumption and line losses). The generated constraint equation is: Sum of all power injections = Sum of all load consumptions + Total line loss power of the loop (which can be estimated through line impedance and current).

[0098] For example, a simple single loop contains one power source (monitoring device P, reporting injected power +100 kW) and one load (monitoring device Q, reporting power consumption 95 kW). Assume the estimated line loss based on line parameters and current is 4 kW. Then the loop power constraint equation is: (Imbalance). Under ideal conditions with no electricity theft, It should be 0.

[0099] Establish operational causal constraints, which are used to limit the recording time of switch state change events to be earlier than the recording time of electrical quantity abnormality events directly caused by the switch state change.

[0100] In this context, "directly caused" refers to a change in the switch state (such as from open to closed) that is the direct cause of a sudden change in subsequent electrical quantities (such as current and power), without any other major interfering events in between.

[0101] Specifically, the system can identify the control relationship between switching devices and the lines or loads they control through a constraint generation module. When a non-command action event of a switch is detected, the module searches for potential electrical quantity mutation events (such as current mutations or power deviations) that may be caused by it within a spatiotemporally proximate range (e.g., on the same line, at a slightly later time). For each such potential cause-effect event pair, a timing inequality constraint is generated: .in, It is the recorded moment of the switch action event. This refers to the recorded time of an abnormal electrical quantity event. For example, the system detects an abnormal event in switch K at node N2 at time... A non-command-based closure action occurred at (10:00:04.500). Subsequently, at monitoring point B on the downstream line of the same node N2, at time... (10:00:04.550) A sudden current surge event was detected. The system determines that there may be a causal relationship between the two events and establishes constraints: .

[0102] The model incorporates node current constraints, signal propagation constraints, loop power constraints, and operational causality constraints to construct a multi-constraint model.

[0103] Among them, the multi-constraint model refers to a set that includes all the above-mentioned types of constraints (equations or inequalities). This set together constitutes a complete mathematical description of the spatiotemporal and electrical quantity relationships that the power network should satisfy under physical laws.

[0104] Specifically, the system can use the model synthesis module to collect the constraint equations and inequalities generated by the constraint generation module for all nodes, all signal propagation paths, all power supply closed loops, and all identified operational causal pairs into a unified data structure (such as a system of equations or a list of constraints). This data structure is the multi-constraint model built for a specific power line and monitoring configuration, which will be used for subsequent time-series calibration and parameter inversion calculations. For example, for a model with 3 monitoring points... For a simple system with two main nodes and one main loop, the multi-constraint model generated by the model synthesis module may include: two node current constraint equations (for the two nodes) and two signal propagation constraint inequalities. One loop power constraint equation and one operational causality constraint inequality (if identified). This set of approximately six constraints constitutes the multi-constraint model for this scenario.

[0105] Therefore, according to the above implementation method, the system can automatically construct a mathematical model (multi-constraint model) based on physical laws and network topology to accurately describe the spatiotemporal relationships and electrical correlations that the monitoring data should satisfy. This model provides an indispensable physical law benchmark for calibrating the time deviation of each monitoring device and inferring hidden abnormal electrical parameters (such as current / power imbalance caused by electricity theft) in the absence of an absolute time reference.

[0106] In some embodiments, using the local timestamps recorded by each monitoring device as the observation and a multi-constraint model as the intrinsic benchmark, the clock offset of each monitoring device relative to the system logical time is iteratively calculated by solving an optimization problem, including:

[0107] Define a time deviation parameter for each monitoring device.

[0108] The time deviation parameter is an unknown variable to be solved, representing the fixed time difference, in seconds, between the local clock of a specific monitoring device and a unified system logical time base. This parameter is unknown before solving and is used to correct the device's timestamp after solving.

[0109] Specifically, the system can use the parameter initialization module to assign a symbolic variable (e.g., ...) to each monitoring device participating in the analysis in the topology network. Let be the time deviation parameters of the device. These parameters together constitute the vector of unknowns to be solved. For example, for a device containing three monitoring devices... The system defines time deviation parameters. These correspond to the clock deviations of devices A, B, and C relative to the system logic time, respectively.

[0110] Based on the multi-constraint model, a joint equation system is constructed with the time deviation parameters of each monitoring device as unknowns. The joint equation system includes:

[0111] Based on signal propagation constraints and operational causality constraints, time series equations are established for event pairs subject to these constraints.

[0112] Timing equations are a modeling method that transforms physical constraints into mathematical equations that include time deviation parameters. For signal propagation constraints, the equations describe the time relationship required for a signal to propagate from one monitoring point to another; for operational causality constraints, the equations describe the time relationship in which a causal event (switching action) must occur before a result event (change in electrical quantity). In the equations, the original recorded timestamp of the event plus the corresponding device's time deviation parameter equals the corrected system logical time of that event.

[0113] Specifically, the system can use an equation building module to traverse all constraint pairs established based on signal propagation and operational causality. For each constraint "Event E1 (occurring on device M) should be earlier than event E2 (occurring on device N)," the unknown time deviation parameters of the devices are introduced to construct a model of the form... The inequality, or simplified to Linear inequalities. For strict causality, It can be set to 0. For example, for a signal propagation constraint: the event recorded by device A should be at least earlier than the corresponding event recorded by device B. (e.g., 25 microseconds). Assume the event is recorded locally on device A in a time interval of 1000 microseconds. Seconds, the time recorded locally on device B is Seconds. The constructed time inequality is: Organized .

[0114] Based on node current constraints, a current continuity equation is established for any node in the topological connection at the moment an event occurs.

[0115] The current continuity equation is based on Kirchhoff's Current Law (KCL) and is a current balance equation established for a topology node at a specific system logic moment. In the equation, the algebraic sum of the current measurements of each branch (corrected to the same moment according to the time deviation parameters of their respective devices) should be zero, or close to zero (considering a small error tolerance). ).

[0116] Specifically, the system can use an equation construction module to select a critical system logic moment when multiple abnormal events occur. For each node in the network, find all nodes at that time. Monitoring equipment with current measurement values ​​(the measured values ​​may need to be obtained through interpolation). The current values ​​measured by each device i. (Inflow is positive, outflow is negative) are added together, and the unknown current imbalance that may exist at this node is introduced. As a variable to be determined (used in subsequent steps for electricity theft detection), the following equation is constructed: .in, This indicates that device i will be in local time. The current value is used as the device's current value at system logic time. The contribution value. For example, at system logic moments. For node N, there are device A (upstream inflow) and device B (downstream outflow). Let device A at its local time... The interpolated current is Device B at local time The interpolated current is (The negative sign indicates outflow). The established current continuity equation is: ,Right now The solution process will simultaneously optimize... and .

[0117] Based on loop power constraints, a power balance equation is established for any power supply closed loop in the topological connection at the moment of the event.

[0118] The power balance equation, based on the law of conservation of energy, is established for a closed power supply loop at a specific system logic moment. In the equation, the sum of power injected by all sources within the loop equals the sum of power consumed by all loads and power lost through line losses; the difference is determined by the unknown power imbalance within the loop. (Used to characterize electricity theft or metering errors) Absorption.

[0119] Specifically, the system can construct modules through equations, at the same critical system logic moment. For each power supply closed loop, identify all power monitoring points and load monitoring points. (The last part, "Power points," appears to be an incomplete sentence or fragment.) Injection power (Positive value) and power consumption at load point k Summing (negative values) and adding the line loss estimated based on line parameters and current. And the unbalanced power of the circuit to be determined. Construct the equation: For example, for a simple circuit, at time... The power of the power supply device P (injection) is kW, the power consumed by the load point device Q is The power loss is estimated at 8kW. The established power balance equation is: ,Right now . The solution will be related to the time deviation parameter Optimize together.

[0120] Based on the internal measurement consistency of the equipment, a measurement continuity equation is established for the electrical quantity records of the same monitoring equipment at continuous time points.

[0121] The measurement continuity equation utilizes the smoothness or predictability of the sampling data of the same monitoring device over a short period of time (e.g., the load will not change infinitely in a step), to establish a relationship between the data of the same device at different sampling times, thereby constraining the time deviation parameter of the device itself.

[0122] Specifically, the system can use an equation building module to select two very close consecutive sampling times t1 and t2 (in system logic time) for a single monitoring device. Assuming that the electrical quantity (e.g., current) measured by the device changes only slightly within this very short time interval, a simple model (e.g., linear interpolation) can be used to correlate the measurements at these two times. The resulting equation will contain the time deviation parameter corresponding to the device at times t1 and t2. For example, for device A, two consecutive local sampling points are selected, with original timestamps of... and The corresponding current measurement value is and On the system's logical timeline, these two moments should be... Assuming the time interval is very short (e.g., 1 second) and the current change is gradual, it can be considered that... .because These are known constants; the simplified equation mainly applies to the measured values. and The rationality of the formation of constraints, indirect constraints The corrected sequence must not exhibit non-physical abrupt changes. A more common approach is to constrain the difference in corrected values ​​between adjacent sampling points within a certain range: .

[0123] Solve the joint equation system to obtain a set of time deviation parameters that minimize the sum of squared residuals of all equations, which can be used as the clock offset of each monitoring device.

[0124] The residual sum of squares refers to the scalar value obtained by squaring the difference between the left and right sides (i.e., the residual) of each constraint equation (an equation or inequality transformed into an equation), and then summing the squared residuals of all equations. Minimizing this value means finding a set of time deviation parameters that maximizes the satisfaction of all constraints in the least squares sense.

[0125] Specifically, the system can optimize the solution module (e.g., using the Levenberg-Marquardt algorithm or the Gauss-Newton algorithm) to construct a large-scale overdetermined or underdetermined nonlinear equation system from all the time-series inequalities (which can be converted into equations with relaxation variables), current continuity equations, power balance equations, and measurement continuity equations established in the above steps. This module uses the time deviation parameters of all devices (…) and the imbalance of each node / loop. To optimize the variables, an iterative numerical solution is performed with the objective of minimizing the sum of squared residuals of all equations. When the iteration converges or reaches the maximum number of iterations, a set of time deviation parameters is output. This refers to the clock offset of each device. For example, for a system with 3 devices, 5 node constraints, 3 timing constraints, 2 loop constraints, and several measurement continuity constraints, the optimization solution module constructs a system of equations containing approximately 20 equations, with 3 unknowns. And several imbalance quantities. After 15 iterations of the LM algorithm, the sum of squared residuals decreased from the initial 1000 to below 0.05, and the solution was obtained after convergence: Second, Second, Seconds. This means that device A's clock is 0.8 seconds fast, device B's clock is 0.2 seconds slow, and device C's clock is 0.1 seconds fast.

[0126] Therefore, according to the above implementation method, the system can transform the calibration problem of local timestamps of each device into a mathematical optimization problem with physical laws (multi-constraint model) as the intrinsic benchmark and minimizing the overall degree of violation as the objective. By solving this problem, the system can autonomously and accurately estimate the clock deviation of each monitoring device relative to the unified system logic time without any external high-precision clock source. This lays a crucial time synchronization foundation for subsequently constructing a globally consistent event sequence and accurately retrieving electricity theft characteristic parameters.

[0127] In some embodiments, clock offsets are used to compensate for and align the recorded timestamps of all events, generating a globally consistent event timing log. Based on this event timing log, the node current imbalance and loop power imbalance are inverted and solved, including:

[0128] Step 1: Using the clock offset of each monitoring device obtained from the solution, compensate for the timestamp of each event record to obtain the corrected physical time of each event.

[0129] Among them, deviation compensation refers to adding (if the clock offset is positive) or subtracting (if the clock offset is negative) the clock offset of the corresponding monitoring device to the original local record timestamp of the event; time alignment refers to unifying the timestamps of all events after compensation to the same system logical time base for subsequent processing; corrected physical time refers to the theoretical time when the event occurs on the unified system logical time axis after the device clock offset is corrected.

[0130] Specifically, the system can use the time calibration module to read the clock offset of each monitored device calculated by the timing calibration module (e.g., device A's clock offset). Seconds, Device B (seconds). For each event extracted in step S120, the module obtains the timestamp of the original record of the event and the corresponding device identifier, and then calculates the corrected physical time of the event based on the clock offset of the device: For example, a "current surge event" reported by device B has an original recorded timestamp T of 10:00:05 (10:00:05). The clock offset of device B is known. for Seconds. The time calibration module calculates the corrected physical time T for this event. Similarly, for a "switch non-command action event" reported by device C, its original timestamp T is 10:00:04 for original C, and the offset of device C is... for If the time is seconds, then the corrected physical time T is physical. .

[0131] Step 2: Based on the corrected physical time of all events, perform global time-series sorting to generate a globally consistent event time-series log.

[0132] Global time-series sorting refers to arranging all different types of events from different monitoring devices in order of their corrected physical time from earliest to latest. A globally consistent event time-series log is a structured list or database record in which each record contains detailed information about an event and is organized in a uniform physical time order.

[0133] Specifically, the system can receive the corrected physical time of all events output by the time calibration module through the event sorting module. This module sorts all events according to... The values ​​are sorted in ascending order to generate an ordered list of events. This list is the globally consistent event time-series log, where each event entry includes at least the event type, the physical time of occurrence, the associated monitoring device, and the original measurement or change.

[0134] For example, after calibration and sorting, the system may generate event sequence logs in the following order:

[0135] (1) At 10:00:03.5, abnormal voltage fluctuations began in device A;

[0136] (2) At 10:00:04.2, device B experiences a sudden change in current;

[0137] (3) 10:00:04.5, Device C, switch disconnected without instruction;

[0138] (4) 10:00:06.0, Device A, voltage abnormal fluctuation ends.

[0139] This log eliminates the impact of clock inconsistencies between devices, reflecting the true chronological order of events.

[0140] Step 3: Define node current imbalance and loop power imbalance based on the topology of the power line. Node current imbalance is used to characterize the net injected or outflow current at the topology node that is not recorded by the monitoring equipment, and loop power imbalance is used to characterize the net power loss in the power supply closed loop that is not recorded by the monitoring equipment.

[0141] Here, "unknown variable" is defined as an unknown variable to be solved for each topological node and each power supply / discharge closed loop, according to circuit theory. The node current imbalance (which can be denoted as...) The current imbalance term (which can be denoted as ) is a necessary compensation term to ensure that the algebraic sum of the monitored currents in each branch is zero when applying Kirchhoff's Current Law (KCL) to the i-th node. (This refers to applying the law of conservation of energy to the first...) In a single-circuit system, a compensation term is necessary to ensure that the sum of the input power equals the sum of the output power and losses. These imbalances are directly related to potential electricity theft or unmonitored abnormal losses.

[0142] Specifically, the system can use a parameter definition module to create a node current imbalance variable for each node (bus or connection point) in the loaded power grid topology diagram. Simultaneously, a loop power imbalance variable is created for each identified power supply closed loop. These variables will appear as unknowns in subsequent equations. For example, for a distribution network with 5 nodes (N1 to N5) and 3 main loops (L1 to L3), the system will define the current imbalance at the 5 nodes: ; and the power imbalance of the three circuits: The units for these variables are amperes (A) and kilowatts (kW), respectively.

[0143] Step 4: Based on the globally consistent event time sequence log, select the physical time when multiple types of abnormal events occurred.

[0144] Among them, the physical moment when multiple abnormal events occur refers to a point in time or a short period of time in the globally consistent event time sequence log where multiple types of abnormal events occur simultaneously or successively (e.g., switching actions, current surges, and voltage fluctuations occur at the same time or in succession). This moment is usually the analysis window where abnormal behaviors such as electricity theft are most active and have the most obvious characteristics.

[0145] Specifically, the system can use a critical moment selection module to scan a globally consistent event timing log to find areas where events occur densely. This module can set a time window (e.g., 2 seconds). When at least two different types of abnormal events occur within this window (e.g., at least one switching event and one electrical quantity surge event), the center or starting point of this time window is selected as the critical physical moment T0 for inversion solution. For example, observing from the event timing log that near 10:00:04.2 seconds (current surge) and 10:00:04.5 seconds (switching action), there is also a voltage fluctuation event starting at 10:00:03.5 seconds. The system selects the time window. Since this window contains various events such as sudden current changes, switching actions, and continuous voltage fluctuations, T0=10:00:04.5 seconds was selected as the key physical moment for analysis.

[0146] Step 5: At physical time, establish a node current balance equation for each node in the topological connection relationship based on the node current constraint. The node current balance equation includes the node current imbalance corresponding to that node as an unknown quantity.

[0147] The node current balance equations are formulated based on Kirchhoff's current law, at a selected physical time T0, for a specific topological node. The left side of the equations is the algebraic sum of the current measurements (obtained after time compensation and interpolation) of all monitoring devices connected to the node at time T0. The right side of the equations is zero, but introduces the node current imbalance. As an unknown to balance possible imbalances.

[0148] Specifically, the system can use an equation-building module to perform the following operations for each node in the topology graph at time T0: First, identify all monitoring devices connected to that node. Then, using an interpolation algorithm (such as linear interpolation), calculate the corrected physical time for each device from its original time-series data. The corresponding instantaneous current value Then, all of them Add them together (positive for inflow, negative for outflow) and let the sum equal the current imbalance at that node. The negative value of is used to establish the equation: For example, for node N2, at time T0, it is connected to upstream device A and downstream device B. Assume that interpolation yields: (Inflow), (Outflow). The established node current balance equation is: Simplify to Here The unknown quantity to be solved is the equation. . A negative value indicates that there is a 5-ampere current flowing outward at that node that has not been recorded by any monitoring device. This is the node current imbalance, which may indicate an unmonitored load or anomaly.

[0149] Step 6: At physical time, based on loop power constraints, establish a loop power balance equation for each power supply closed loop in the topological connection relationship. The loop power balance equation includes the corresponding loop power imbalance as an unknown quantity.

[0150] The loop power balance equation is based on the law of conservation of energy and is written for a specific closed power supply loop at a selected physical time T0. In the equation, the sum of the input power at all power monitoring points within the loop, minus the sum of the output power at all load monitoring points, and then minus the estimated line losses, should equal zero. The loop power imbalance is introduced. As an unknown, it is used to absorb actual imbalances.

[0151] Specifically, the system can use an equation construction module to perform the following operations for each power supply closed loop at time T0: identify all power sources (such as substation outlets) and load points (such as user sides) in the loop, and obtain the instantaneous power value of the corresponding monitoring equipment at time T0. and (Obtained through interpolation). Simultaneously, line losses are estimated based on loop impedance and current current. Establish the equation: For example, for a simple loop, at time T0, the power at the source point is... kW, point-of-load power kW, estimated line loss kW. The established loop power balance equation is: Simplify to . If the solution result is negative, it indicates that there is additional, undetected power consumption (net loss).

[0152] Step 7: Verify the globally consistent event timing log based on signal propagation constraints and operational causality constraints. If a timing conflict is detected, additional constraints are introduced into the balance equation of the corresponding node or loop to explain the timing conflict.

[0153] Timing conflicts refer to situations in a globally consistent event timing log where the order of events violates signal propagation constraints or operational causality constraints established based on physical laws. To explain these conflicts, it is necessary to assume the existence of additional, undetected current injections / outflows or power losses that "cause" the observed anomalous timing. Additional constraints are the extra equations introduced to express this assumption, directly equating the theoretically calculated deviation value with the corresponding unbalance variable at the node or loop.

[0154] Specifically, the system can use a conflict detection and interpretation module to traverse the event timing log and check each pair of events that may have a physical relationship (such as upstream voltage fluctuations and downstream current surges, or switching actions and subsequent changes in electrical quantities). If it is found that the downstream event is recorded earlier than the upstream event plus the minimum propagation delay, or the change in electrical quantity occurs earlier than the switching action that triggered it, a timing conflict is determined to exist. Then, the module calculates a theoretical current deviation value based on the conflict type and line parameters. ) or power deviation value ( This value represents the additional imbalance that must exist on the relevant node or loop to "explain" this timing conflict. Then, the module establishes a... or The additional constraint equations are added to the system of equations established in steps 5 and 6. For example, according to the topology, the theoretical minimum propagation delay of a signal from device A to device B is... The time is 2 milliseconds. In the timing log, device B records the event time as 2 milliseconds. The relevant event timestamps recorded by device A are as follows: Even with the compensation of time, there is still Although the difference is small, it theoretically violates the constraint that "upstream precedes downstream." To explain this tiny "time reversal," the system assumes a rapid, unmonitored current disturbance at node B. Based on the electromagnetic transient theory, it is estimated that... ,in Z is the voltage fluctuation amplitude, and Z is the line impedance. It's a proportionality constant. Assuming it's calculated... (Indicating outflow). The system then establishes additional constraint equations: ,in It is the current imbalance at node B.

[0155] Step 8: Solve the system of equations consisting of all node current balance equations, loop power balance equations, and additional constraints to obtain numerical solutions for node current imbalance and loop power imbalance that minimize the sum of squared residuals of all equations.

[0156] Here, "all equations" refers to a set of equations consisting of the current balance equations established for all nodes in step 5, the power balance equations established for all loops in step 6, and the additional constraint equations introduced in step 7 to explain timing conflicts. Because the number of equations may exceed the number of unknowns (over-determined equations) or measurement errors may exist, it is usually impossible to find a solution that makes all equations strictly true. Therefore, the goal of the solution is to find a set of node current imbalances (…). ) and circuit power imbalance ( The value of ) minimizes the sum of squares of the residuals (the differences between the left and right sides of the equations) of all equations, which is usually achieved by optimization algorithms such as the Least Squares Method.

[0157] Specifically, the system can use the parameter inversion solution module to rearrange all the above linear equations into matrix form. , where x is the subset of all and Let A be an unknown vector, A be a coefficient matrix, and b be a constant vector. This module calls numerical computation libraries (such as NumPy's numpy.linalg.lstsq function or SciPy's scipy.optimize.least_squares function) to solve this least squares problem, obtaining the result that... Minimum solution vector Solution vector Each component in the equation represents the optimal estimate of the current imbalance at each node and the power imbalance in each loop. For example, for a system with 3 node balance equations, 2 loop balance equations, and 1 additional constraint equation, there are a total of 6 equations and 3 unknowns. and 2 There are a total of 5 unknowns. The solution module uses the least squares method to obtain a solution: These numerical solutions quantify the abnormal currents and power at each node and loop that were not interpreted by the monitored equipment.

[0158] Therefore, according to the above implementation method, the system can first construct a logically consistent sequence of events using a calibrated time base, and then establish a mathematical model (balance equation) describing the system state based on fundamental circuit laws at a key time slice. By introducing the variable of "imbalance quantity" to characterize the monitoring blind zone, and cleverly transforming the observed temporal physical conflicts into additional constraints on these imbalance quantities, the system can finally accurately and quantitatively calculate the node current imbalance and loop power imbalance that characterize potential electricity theft by solving an optimization problem. This provides a direct and reliable quantitative input for subsequent feature-based electricity theft determination.

[0159] In some embodiments, time-domain features are extracted from node current imbalance and loop power imbalance. The extracted time-domain features are correlated with a sequence of switching events. Based on the analysis results, a determination result of the electricity theft event is output according to a preset decision logic, including:

[0160] Within the set analysis time window, multiple feature parameters are extracted from the current imbalance sequence of each node and the power imbalance sequence of each loop.

[0161] Among them, the analysis time window is a pre-set time interval for statistical analysis, such as the past 30 minutes or 1 hour; the node current imbalance sequence refers to a set of ordered values ​​formed by the change of the node current imbalance of a specific node over time within the analysis time window; the loop power imbalance sequence is similar, referring to the sequence of the change of the unbalanced power of a specific loop over time.

[0162] Specifically, the system can use a feature extraction module to maintain a rolling data buffer in memory for each monitored topology node and power supply closed loop, to store data within the most recent analysis time window (e.g., The node current imbalance continuously calculated by the parameter inversion module ( ) and circuit power imbalance ( The module reads the complete time-series data from the buffers of each node and each circuit when a theft detection is required. For example, the system sets the analysis time window length to 30 minutes. For node N5, its feature extraction module reads all data within 30 minutes prior to the current time T. The sampled values ​​form a sequence containing 1800 data points (assuming a sampling interval of 1 second): Similarly, for loop L2, the reads form a sequence. .

[0163] Several characteristic parameters include: the arithmetic mean of each sequence within the analysis time window, the standard deviation of each sequence within the analysis time window, and the correlation parameter between each sequence and the switch event sequence.

[0164] The arithmetic mean is a statistic used to measure the central tendency of a sequence, and its calculation formula is: ,in It is the first in the sequence There are _N_ values, where N is the total number of data points in the sequence; the standard deviation is a statistic used to measure the dispersion or volatility of the sequence, calculated using the formula: The correlation parameter is an indicator used to quantify the strength of the correlation between two time series. Here, it specifically refers to the degree of synchronization between the node current imbalance sequence (or loop power imbalance sequence) and the switching event sequence in time. It can be obtained by calculating the peak value of the cross-correlation function or the correlation coefficient under a specific delay.

[0165] Specifically, the system can use the feature calculation submodule to process each read sequence ( or Perform the following calculations:

[0166] (1) Calculate the arithmetic mean by calling the numpy.mean() function (the mean function in the NumPy library). ;

[0167] (2) Calculate the standard deviation by calling the numpy.std() function (the standard deviation function in the NumPy library). ;

[0168] (3) Call the scipy.signal.correlate() function (the cross-correlation function in the SciPy library) or other time series similarity algorithms to calculate the correlation parameter C between the sequence and the switch event sequence. For example, use the maximum normalized cross-correlation coefficient as the value of C.

[0169] For example, for the sequence of node N5 The arithmetic mean was calculated. Ampere (A), standard deviation The correlation parameter with the sequence of switching events For the sequence of loop L2 Calculations yielded kilowatts (kW) kW, .

[0170] Obtain the occurrence times of all non-command action events of switches within the analysis time window to form a switch event sequence.

[0171] The switch event sequence is a list of multiple time points, each time point corresponding to the physical occurrence time (after time calibration) of a non-command switch action event that occurred within the analysis time window.

[0172] Specifically, the system can use the event sequence construction module to query globally consistent event time-series logs and filter out events of type "non-command action for switching" whose physical occurrence time falls within the current analysis time window. All event records within the batch. Extract the "Physical Occurrence Time" field from these event records and sort them chronologically to form an ordered list of time points, i.e., the switch event sequence. For example, within the current 30-minute analysis time window, the system selected three non-command action events for switching on / off from the time-series log. Their physical occurrence times are as follows: The constructed switch event sequence is then... This sequence will serve as a baseline for comparison with all and Calculate the correlation degree of the sequences.

[0173] Based on preset judgment thresholds, criteria for identifying electricity theft at nodes and electricity theft in circuits are set.

[0174] Among them, the judgment threshold is a set of numerical thresholds pre-set based on historical normal data statistical analysis, expert experience, or regulatory requirements; the node electricity theft identification criterion is a set of logical conditions used to determine whether the characteristic parameters of a node match the electricity theft behavior pattern; the circuit electricity theft identification criterion is another set of logical conditions used to determine whether the characteristic parameters of a circuit match the electricity theft behavior pattern.

[0175] Specifically, the system can load preset decision thresholds through the criterion configuration module. These thresholds typically include: the average current imbalance threshold. Current imbalance standard deviation threshold Current-switch correlation threshold Power imbalance mean threshold Power imbalance standard deviation threshold Power-switching correlation threshold Then, the module uses these thresholds to define criteria. For example, the criterion for identifying node electricity theft can be set to simultaneously satisfy the following three conditions: (The mean of the imbalance is significant) (The imbalance fluctuates little and shows stable performance) (Highly correlated with switch operation). The circuit theft detection criteria can be similarly set as follows: For example, the system's preset decision threshold is: The node criterion is: and and The loop criterion is: and and .

[0176] If multiple characteristic parameters of a node current imbalance sequence corresponding to a node simultaneously satisfy the node-wide electricity theft identification criteria for that node, then the node is determined to have experienced an electricity theft event; or, if multiple characteristic parameters of a loop power imbalance sequence corresponding to a loop simultaneously satisfy the loop-wide electricity theft identification criteria for that loop, then the loop is determined to have experienced an electricity theft event.

[0177] "In response to" means that when the system detects that the above logical condition is true, it will automatically trigger the subsequent judgment action; "satisfy all criteria at the same time" means that the conditions for determining electricity theft are relatively strict, requiring multiple dimensions of feature evidence to point to electricity theft, which helps to reduce the false alarm rate.

[0178] Specifically, the system can use the electricity theft detection module to traverse all nodes and circuits. For each node, it calculates the node's characteristic parameters. Substitute the node electricity theft detection criteria into the logical judgment. If all comparison results are "True", then generate a judgment result: "Node [Node ID] has experienced an electricity theft event". Perform a similar operation for each loop, using... The module establishes criteria for identifying electricity theft via loops. It ultimately outputs a list of results. For example, for node N5, its characteristic parameters are: Substitute the criteria: The condition is true if 2.1 < 5, and true if 0.76 > 0.7. All three conditions are true, therefore the decision module determines that node N5 has experienced an electricity theft event. For loop L2, its characteristic parameters are: Substituting the criteria: |8.7|>5 is true, 1.5<3 is true, 0.82>0.7 is true, all are satisfied, therefore, it is determined that an electricity theft event has occurred in loop L2. The system outputs these two judgment results.

[0179] Therefore, according to the above implementation method, the system can transform the node current imbalance and loop power imbalance, which characterize the unmonitored power flow and are obtained from the previous steps, into stable and quantifiable time-domain features (mean, standard deviation, correlation). By performing correlation analysis with illegal switching operation sequences and making comprehensive judgments based on strict multi-dimensional criteria, the system can ultimately automatically, accurately, and reliably identify electricity theft events from multi-source asynchronous data, greatly improving the intelligence level and accuracy of anti-electricity theft work.

[0180] In some embodiments, within a set analysis time window, multiple feature parameters are extracted for each node current imbalance sequence and each loop power imbalance sequence, including:

[0181] Calculate the arithmetic mean of the current imbalance sequence of each node within the analysis time window, and use it as the mean parameter for that node.

[0182] The mean parameter, measured in amperes (A), is a core indicator used to quantify the overall level of current imbalance at a node within the analysis time window. A consistently negative mean parameter with a large absolute value indicates a stable and significant net current outflow at the node, which is one of the typical electrical characteristics of electricity theft.

[0183] Specifically, the system can use the feature calculation module to calculate the mean value from the time series data of node current imbalance stored in the buffer by calling the mean function in the numerical computing library (e.g., the numpy.mean() function in Python's NumPy library). This function sums all data points and divides by the total number of data points to obtain the arithmetic mean. For example, for node N3, within an analysis time window of 30 minutes, its current imbalance sequence... It contains 1800 samples (sampling interval 1 second). The arithmetic mean of this sequence is calculated to be... A. This indicates that over the past 30 minutes, an average of approximately 15.5A of current per hour has been lost from node N3 without being measured by the monitoring equipment. Recorded as A.

[0184] Calculate the standard deviation of the current imbalance sequence at each node within the analysis time window, and use it as the stability parameter for that node.

[0185] The stability parameter is a statistical indicator used to measure the magnitude of current imbalance fluctuations at a node, measured in amperes (A). A smaller standard deviation indicates that the imbalance changes smoothly over time, exhibiting a stable behavior pattern; while a larger standard deviation indicates severe fluctuations, possibly caused by intermittent loads or measurement noise. Stable abnormal current loss is more consistent with electricity theft characteristics.

[0186] Specifically, the system can use the feature calculation module to calculate the standard deviation of the time series data of current imbalance at the same node by calling the standard deviation function in the numerical computing library (e.g., the numpy.std() function in the NumPy library, which calculates the sample standard deviation by default). This function quantifies the average degree to which each data point in the sequence deviates from its arithmetic mean. For example, continuing with the sequence for node N3... The calculated standard deviation is 2.1A. This relatively small stability parameter... This indicates that the node is approximately The imbalance fluctuation range is very small and the behavior pattern is stable, which increases its likelihood of being a suspected node for electricity theft.

[0187] Calculate the arithmetic mean of the power imbalance sequence for each loop within the analysis time window, and use it as the mean parameter for that loop.

[0188] The mean parameter, measured in kW, is a core indicator used to quantify the overall power imbalance level of the circuit within the analysis time window. A consistently positive and large mean parameter indicates that the circuit has stable and significant net power loss, which is a typical characteristic of circuit-level power theft or abnormal losses.

[0189] Specifically, the system can use the feature calculation module to calculate the arithmetic mean of the time series data of loop power imbalance stored in the buffer using the numpy.mean() function. For example, for loop L1, within the same 30-minute analysis time window, its power imbalance sequence... The arithmetic mean is 8.7 kW. This means that over the past 30 minutes, an average of approximately 8.7 kW of power per hour in loop L1 has not been measured by the monitoring equipment. It was recorded as 8.7kW.

[0190] Calculate the standard deviation of the power imbalance sequence for each loop within the analysis time window, and use it as the stability parameter for that loop.

[0191] The stability parameter is a statistical indicator used to measure the magnitude of power imbalance fluctuations in the circuit, measured in kilowatts. Similar to current imbalance, a smaller standard deviation indicates stable abnormal power loss, which is more likely to stem from persistent illegal electricity use.

[0192] Specifically, the system can use the feature calculation module to calculate the standard deviation of the time series data of power imbalance in the same loop by calling the numpy.std() function. For example, continuing with the series of loop L1... The calculated standard deviation is 1.5 kW. This stability parameter... The kW indicates that the abnormal power loss fluctuation of approximately 8.7kW is small, and the behavior pattern remains stable.

[0193] The correlation parameter between the current imbalance sequence of each node and the switching event sequence is calculated using the cross-correlation function calculation method.

[0194] The correlation parameter is a dimensionless coefficient used to quantify the temporal synchronicity between changes in node current imbalance and non-command switching actions. Its value typically ranges from [value range missing in original text]. The closer the value is to 1, the stronger the positive correlation between the two over time; that is, after the switch is activated, the current imbalance often changes in a specific direction.

[0195] Specifically, the system can first use the feature calculation module to process the switch event sequence. (Constituted from a series of time points) is transformed into a binary time series. On the same time axis as the current imbalance sequence, the point where the switching event occurs is marked as 1, and all other points are marked as 0. Then, the cross-correlation function in a signal processing library (e.g., the scipy.signal.correlate() function in Python's SciPy library) is called to calculate the current imbalance sequence. With binary switch sequence A sequence of cross-correlation coefficients. Correlation parameter. Typically, the maximum absolute value of the cross-correlation coefficient sequence is taken, or the maximum value within a reasonable time window near zero delay. For example, for node N3... and the converted switch sequence The maximum absolute value in the calculated cross-correlation coefficient sequence is 0.78. Therefore, the current-switch correlation parameter of node N3... It was recorded as 0.78. This indicates that the current imbalance change at this node has a strong temporal correlation with the switching action event.

[0196] The correlation parameter between the power imbalance sequence of each loop and the switching event sequence is calculated using the cross-correlation function calculation method.

[0197] The correlation parameter, used to quantify the temporal synchronicity between changes in circuit power imbalance and unauthorized switch actions, is also a dimensionless coefficient. A high correlation indicates that abnormal power loss at the circuit level often occurs immediately following a specific switch operation, which is key evidence for determining the causal relationship of electricity theft.

[0198] Specifically, the system can use the feature calculation module to calculate the circuit power imbalance sequence using the same method as that used to calculate the current-switch correlation. With the same binary switch sequence The cross-correlation function between them was analyzed, and its eigenvalues ​​were extracted as correlation parameters. For example, for loop L1 and The calculated maximum absolute value of the cross-correlation coefficient sequence is 0.82. Therefore, the power-switch correlation parameter of loop L1 is... The value was recorded as 0.82, indicating that the abnormal power loss of the circuit was highly correlated with the switching action event in time.

[0199] Therefore, according to the above implementation method, the system can automatically calculate a set of quantitative characteristic parameters, including mean, stability, and correlation, for each monitoring node and power supply circuit. These parameters accurately characterize the electrical features of potential electricity theft from three dimensions: "abnormality level," "behavioral stability," and "spatiotemporal correlation with illegal operations," providing a reliable and quantitative input basis for subsequent intelligent judgments based on multi-dimensional thresholds.

[0200] Figure 3 This is a structural block diagram of an embodiment of the electricity theft identification system based on multi-source data according to the present invention.

[0201] like Figure 3 As shown, the electricity theft detection system based on multi-source data includes:

[0202] The time series dataset construction module 210 is used to collect the operation data streams and local timestamps corresponding to each data point reported by multiple monitoring devices deployed on the same power line during the same time period, and to establish a mapping relationship between operation data points and timestamps for each monitoring device to obtain multiple sets of time series datasets.

[0203] The abnormal event extraction module 220 is used to perform anomaly detection on each group of time series datasets and extract electrical quantity mutation events or non-command switching action events that exceed a preset threshold in each group of time series datasets.

[0204] The multi-constraint model construction module 230 is used to construct a multi-constraint model based on the topological connection relationship of power lines and Kirchhoff's laws and the law of conservation of energy. The multi-constraint model is used to describe the causal time sequence relationship and electrical quantity coupling relationship between events at different monitoring points.

[0205] The clock offset calculation module 240 is used to calculate the clock offset of each monitoring device relative to the system logic time by solving optimization problems, using the local timestamps recorded by each monitoring device as the observation and the multi-constraint model as the internal benchmark.

[0206] The imbalance calculation module 250 is used to compensate for the deviation and align the timestamps of all events using the clock offset, generate a globally consistent event timing log, and solve the node current imbalance and loop power imbalance based on the event timing log.

[0207] The electricity theft identification result output module 260 is used to extract time-domain features of node current imbalance and circuit power imbalance, perform correlation analysis between the extracted time-domain features and the switch event sequence, and output the judgment result of the electricity theft event based on the analysis result and the preset judgment logic.

[0208] The specific functions and examples of each module and submodule of the device in this embodiment of the invention can be found in the relevant descriptions of the corresponding steps in the above method embodiments, and will not be repeated here.

[0209] According to embodiments of the present invention, the above-described method of the present invention can be applied to an electronic device and a readable storage medium.

[0210] Figure 4 A schematic block diagram of an example electronic device 600 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0211] like Figure 4 As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0212] Multiple components in electronic device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of displays, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows electronic device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0213] The computing unit 601 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as a method for identifying electricity theft based on multi-source data. For example, in some embodiments, a method for identifying electricity theft based on multi-source data can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of a method for identifying electricity theft based on multi-source data described above can be performed. Alternatively, in other embodiments, the computing unit 601 may be configured by any other suitable means (e.g., by means of firmware) to perform a multi-source data-based electricity theft detection method.

[0214] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0215] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0216] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0217] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0218] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0219] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0220] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this invention can be achieved, and this is not limited herein.

[0221] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for identifying electricity theft based on multi-source data, characterized in that, include: The system collects the operational data streams and local timestamps corresponding to each data point reported by multiple monitoring devices deployed on the same power line during the same time period, and establishes a mapping relationship between operational data points and timestamps for each monitoring device to obtain multiple sets of time series datasets. Anomaly detection is performed on each group of time series datasets, and electrical quantity mutation events or non-command switching action events exceeding a preset threshold are extracted from each group of time series datasets. Based on the topological connection of the power lines and Kirchhoff's laws and the law of conservation of energy, a multi-constraint model is constructed. The multi-constraint model is used to describe the causal temporal relationship and electrical quantity coupling relationship between events at different monitoring points. Using the local timestamps recorded by each monitoring device as the observation and the multi-constraint model as the intrinsic benchmark, the clock offset of each monitoring device relative to the system logical time is iteratively calculated by solving the optimization problem. The clock offset is used to compensate for the deviation and align the timestamps of all events to generate a globally consistent event time sequence log. Based on the event time sequence log, the target physical time is selected, and the node current balance equation is constructed using Kirchhoff's current law. The node current imbalance, which characterizes the net injection or outflow current on the topology node that is not recorded by the monitoring device, is obtained by solving the equation. The loop power balance equation is constructed using the law of conservation of energy, and the loop power imbalance, which characterizes the net power loss not recorded by the monitored equipment in the closed loop of power supply and consumption, is obtained by solving it. The node current imbalance and circuit power imbalance are subjected to time-domain feature extraction. The extracted time-domain features are correlated with the switching event sequence. Based on the analysis results, the determination result of the electricity theft event is output according to the preset judgment logic.

2. The method according to claim 1, characterized in that, Each group of time series datasets includes corresponding current data sequences, voltage data sequences, power data sequences, and switch state sequences; the anomaly detection of each group of time series datasets, extracting electrical quantity mutation events or non-command switching action events exceeding a preset threshold in each group of time series datasets, includes: Continuous analysis of the current data sequence is performed to extract events in which the change in current value within a unit of time exceeds the current anomaly judgment threshold, which are recorded as current mutation events. Continuous analysis of the voltage data sequence is performed to extract events in which the voltage value deviates from the rated range and the duration reaches the voltage anomaly judgment threshold, which are recorded as voltage anomaly fluctuation events. Continuous analysis of the power data sequence is performed to extract events in which the difference between the power value and the normal load power benchmark value exceeds the power anomaly judgment threshold, which are recorded as power deviation events. The switch state sequence is monitored in real time, and events in which state switching occurs when no valid remote or local operation command is issued are extracted and recorded as switch non-command action events.

3. The method according to claim 1, characterized in that, Based on the topological connections of the power lines and Kirchhoff's laws and the law of conservation of energy, a multi-constraint model is constructed, including: Based on the topological connection relationship of the power lines, determine the monitoring points of each monitoring device in the topological connection relationship; Node current constraints are established based on Kirchhoff's current law, which are used to limit the algebraic sum of the currents flowing into and out of any topological node to zero. Establish a signal propagation constraint, which is used to limit the time when the monitoring point located upstream of the signal propagation path records the event to be earlier than the time when the monitoring point downstream records the corresponding event; A loop power constraint is established based on the law of conservation of energy. The loop power constraint is used to limit the total input power in any power supply closed loop to be equal to the sum of the load power consumption and the line loss power. Establish an operational causal constraint, which is used to limit the recording time of a switch state change event to be earlier than the recording time of an electrical quantity abnormality event directly caused by the switch state change; The node current constraints, signal propagation constraints, loop power constraints, and operational causality constraints are combined to construct the multi-constraint model.

4. The method according to claim 3, characterized in that, The method uses the local timestamps recorded by each monitoring device as the observation, and the multi-constraint model as the intrinsic benchmark, to iteratively calculate the clock offset of each monitoring device relative to the system logical time by solving an optimization problem, including: Define a time deviation parameter for each of the monitoring devices; Based on the multi-constraint model, a joint equation system is constructed with the time deviation parameters of each monitoring device as unknowns. The joint equation system includes: Based on the signal propagation constraints and the operational causality constraints, a time series equation is established for the event pairs subject to these constraints. Based on the node current constraints, a current continuity equation is established for any node in the topological connection at the moment the event occurs. Based on the loop power constraints, a power balance equation is established for any power supply closed loop in the topological connection relationship at the moment of the event. Based on the internal measurement consistency of the equipment, a measurement continuity equation is established for the electrical quantity records of the same monitoring equipment at continuous time points; Solving the joint equation system yields a set of time deviation parameters that minimize the sum of squared residuals of all equations, which are used as the clock offsets of each monitoring device.

5. The method according to claim 4, characterized in that, The process involves using the clock offset to compensate for the time discrepancy and align the recorded timestamps of all events, generating a globally consistent event timing log, and then using this event timing log to inversely calculate the node current imbalance and loop power imbalance, including: Using the clock offset of each monitoring device obtained by the solution, the timestamp of each event record is compensated to obtain the corrected physical time of each event; Based on the corrected physical time of all events, a global time sequence is sorted to generate a globally consistent event time sequence log; Based on the topological connection of the power line, node current imbalance and loop power imbalance are defined. The node current imbalance is used to characterize the net injected or outflow current at the topological node that is not recorded by the monitoring equipment, and the loop power imbalance is used to characterize the net power loss in the power supply closed loop that is not recorded by the monitoring equipment. Based on the globally consistent event time-series log, the physical time when multiple types of abnormal events occurred is selected; At the physical moment, based on the node current constraints, a node current balance equation is established for each node in the topological connection relationship. The node current balance equation includes the node current imbalance corresponding to the node as an unknown. At the physical moment, a loop power balance equation is established for each power supply closed loop in the topological connection relationship based on the loop power constraint. The loop power balance equation includes the loop power imbalance corresponding to the loop as an unknown. The globally consistent event timeline log is verified based on the signal propagation constraints and the operation causality constraints. If a timeline conflict is detected, additional constraints are introduced into the balance equation of the corresponding node or loop to explain the timeline conflict. Solve the system of equations consisting of all node current balance equations, loop power balance equations, and additional constraints to obtain numerical solutions for node current imbalance and loop power imbalance that minimize the sum of squared residuals of all equations.

6. The method according to claim 1, characterized in that, The process involves extracting time-domain features from the node current imbalance and circuit power imbalance, correlating the extracted time-domain features with a switching event sequence, and outputting a determination result for the electricity theft event based on the analysis results and a preset decision logic. This includes: Within the set analysis time window, multiple feature parameters are extracted for each node current imbalance sequence and each loop power imbalance sequence. The multiple feature parameters include: the arithmetic mean of each sequence within the analysis time window, the standard deviation of each sequence within the analysis time window, and the correlation parameter between each sequence and the switch event sequence; Obtain the occurrence times of all non-command action events of the switch within the analysis time window to form the switch event sequence; Based on preset judgment thresholds, establish criteria for identifying electricity theft at nodes and electricity theft in circuits; If the multiple feature parameters of the node current imbalance sequence corresponding to a node simultaneously satisfy all the node electricity theft identification criteria for the node, it is determined that the node has experienced an electricity theft event. Alternatively, if the multiple characteristic parameters of a sequence of power imbalances in a circuit simultaneously satisfy all of the circuit theft identification criteria for the circuit, then the circuit is determined to have experienced an electricity theft event.

7. The method according to claim 6, characterized in that, Within the set analysis time window, multiple feature parameters are extracted for each node current imbalance sequence and each loop power imbalance sequence, including: Calculate the arithmetic mean of the current imbalance sequence of each node within the analysis time window, and use it as the mean parameter for that node; Calculate the standard deviation of the current imbalance sequence at each node within the analysis time window, and use it as the stability parameter of that node; Calculate the arithmetic mean of the power imbalance sequence for each loop within the analysis time window, and use it as the mean parameter for that loop; Calculate the standard deviation of the power imbalance sequence for each loop within the analysis time window, and use it as the stability parameter for that loop; The correlation parameter between the current imbalance sequence of each node and the switching event sequence is calculated using the cross-correlation function calculation method. The correlation parameter between the power imbalance sequence of each loop and the switching event sequence is calculated using the cross-correlation function calculation method.

8. A multi-source data-based electricity theft detection system, characterized in that, include: The time series dataset construction module is used to collect the operation data streams and local timestamps corresponding to each data point reported by multiple monitoring devices deployed on the same power line within the same time period, and to establish a mapping relationship between operation data points and timestamps for each monitoring device to obtain multiple sets of time series datasets. An abnormal event extraction module is used to perform anomaly detection on each group of time series datasets and extract electrical quantity mutation events or non-command switching action events that exceed a preset threshold in each group of time series datasets. The multi-constraint model construction module is used to construct a multi-constraint model based on the topological connection relationship of the power line and Kirchhoff's laws and the law of conservation of energy. The multi-constraint model is used to describe the causal temporal relationship and electrical quantity coupling relationship between events at different monitoring points. The clock offset calculation module is used to calculate the clock offset of each monitoring device relative to the system logical time by solving the optimization problem, using the local timestamp recorded by each monitoring device as the observation and the multi-constraint model as the internal benchmark. The imbalance quantity solution module is used to compensate for the deviation and align the recorded timestamps of all events using the clock offset, generate a globally consistent event timing log, select the target physical time based on the event timing log, construct the node current balance equation using Kirchhoff's current law, and solve for the node current imbalance quantity that characterizes the net injection or outflow current on the topology node that is not recorded by the monitoring device. The loop power balance equation is constructed using the law of conservation of energy, and the loop power imbalance, which characterizes the net power loss not recorded by the monitored equipment in the closed loop of power supply and consumption, is obtained by solving it. The electricity theft identification result output module is used to extract time-domain features of the node current imbalance and circuit power imbalance, perform correlation analysis between the extracted time-domain features and the switch event sequence, and output the judgment result of the electricity theft event based on the analysis result and a preset judgment logic.

9. An electronic device, characterized in that, include: At least one processor; and a memory that is communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, in, Computer instructions are used to cause a computer to perform the method according to any one of claims 1-7.

Images