Electric meter tamper-proofing identification method and system based on BERT model

Abstract

The invention discloses an electricity meter tamper-proof identification method and system based on a BERT model, and belongs to the technical field of electric power metrology, the identification method comprises the steps of preprocessing collected structured data and text data, respectively forming feature data and a text sequence, extracting [CLS] vectors according to the text sequence and the BERT model, and fusing the [CLS] vectors and the feature data to obtain an electricity meter tamper-proof identification result. Obtaining a feature vector; and inputting the feature vector into a trained classifier, outputting a risk probability and a risk type that the ammeter has a tampering risk, carrying out association analysis in combination with pre-obtained association information, and generating an alarm work order. According to the method, the structural data and the text data are fully utilized, so that the hidden tampering method can be found and captured more accurately, and an effective basis is provided for subsequent countering attacks. According to the invention, the corresponding response threshold is adjusted according to the associated information, so that a specific application scene can be more accurately adapted, and the alarm accuracy is improved.

Description

A method and system for preventing tampering of electricity meters based on the BERT model Technical Field

[0001] This application relates to the field of power metering technology, specifically to a method and system for tamper-proof identification of electricity meters based on the BERT model. Background Technology

[0002] Given that current meter anti-tampering identification mainly uses rule engines or statistical models, it does not establish event correlations for event logs, nor does it analyze the time sequence of magnetic field interference after the meter is opened; and it does not make sufficient use of semi-structured text information (alarm descriptions, event records, etc.), so it cannot detect new methods of hidden tampering, making it difficult to achieve the goal of countering attacks, and it cannot provide a judgment on the current attack situation. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and system for identifying and preventing tampering of electricity meters based on the BERT model. The invention aims to combine text information and the BERT model for data preprocessing and use the cross-entropy loss function to train the classifier model in order to calculate the probability and type of tampering.

[0004] To achieve the above objectives, the present invention is implemented using the following technical solution:

[0005] In a first aspect, the present invention provides a method for tamper-proof identification of electricity meters based on the BERT model, comprising the following steps:

[0006] Collect structured and text data from the electricity meter terminal;

[0007] The collected structured data and text data are preprocessed to form feature data and text sequences, which serve as the standard inputs to the BERT model, respectively.

[0008] The [CLS] vector is extracted based on the text sequence and the pre-trained BERT model, and the [CLS] vector and the feature data are fused to obtain a feature vector; combined with the feature vector, the cross-entropy loss function and labeled historical electricity meter data are used to train the classifier model; the trained classifier is used to calculate the risk probability and risk type of the electricity meter tampering risk within the current analysis time window;

[0009] Based on the risk probability, risk type, and preset response threshold output by the classifier, and combined with pre-obtained correlation information, an alarm work order is generated through correlation analysis.

[0010] Further, the step of extracting the [CLS] vector based on the text sequence and the pre-trained BERT model includes: adaptively pre-training the basic BERT model by combining pre-obtained power industry text, and inputting the text sequence into the trained BERT model to extract the [CLS] vector.

[0011] Furthermore, the structured data includes voltage, current, power, energy consumption, power factor, load curve, frozen data, meter reading success rate, and communication status;

[0012] The text data includes power failure event records, undervoltage event records, overcurrent event records, alarm information, and operation log information.

[0013] Furthermore, the preprocessing of the collected structured data and text data includes:

[0014] Perform anomalous data processing on structured and text data;

[0015] Perform secondary calculations on structured data to obtain feature data;

[0016] Feature words are extracted from text data to generate text sequences.

[0017] Furthermore, the characteristic data includes: power descent rate, load fluctuation variance, voltage imbalance, and meter reading failure frequency.

[0018] Furthermore, the calculation methods for the power descent rate, load fluctuation variance, voltage imbalance, and meter reading failure frequency are as follows:

[0019] Battery drop rate = (Day-to-date battery level - Actual battery level) / Day-to-date battery level; where, if the current battery level is less than 30% of the day-to-date battery level, then the actual battery level = 0.3 * day-to-date battery level, otherwise the actual battery level = the current battery level;

[0020] Load fluctuation variance = load fluctuation entropy = Ʃ(-hourly load percentage * log2(hourly load percentage)) / log2(number of hourly loads); where, hourly load percentage = hourly load / total hourly load;

[0021] Voltage imbalance = (Maximum three-phase voltage - Minimum three-phase voltage) / Average three-phase voltage;

[0022] Meter reading failure frequency = Communication interruption frequency = Number of data collection failures / Total number of data collections.

[0023] Furthermore, the abnormal data processing of structured data and text data includes: removing outliers, null values, and duplicate values.

[0024] Furthermore, the text sequence is input into the trained BERT model to extract the [CLS] vector, including: using a multi-layer Transformer Encoder to learn a deep-level representation of the contextual relevance of each token in the text sequence, and outputting the [CLS] vector in the text sequence.

[0025] Furthermore, in the process of fusing [CLS] vectors and feature data, an attention mechanism is used to enable the classifier to assign weights to semantic features based on semantic relevance.

[0026] Secondly, the present invention provides a meter anti-tampering identification system based on the BERT model, comprising: a data acquisition module, a data preprocessing module, a feature extraction and fusion training module, and a risk judgment and alarm module;

[0027] The data acquisition module is used to collect structured and text data from the electricity meter terminal;

[0028] The data preprocessing module is used to preprocess the collected structured data and text data to form feature data and text sequences, which serve as the standard inputs to the BERT model, respectively.

[0029] The feature extraction and fusion training module is used to extract the [CLS] vector based on the text sequence and the pre-trained BERT model, and fuse the [CLS] vector and the feature data to obtain a feature vector; combined with the feature vector, the classifier is trained using the cross-entropy loss function and labeled historical electricity meter data; the trained classifier is used to calculate the risk probability and risk type of the electricity meter tampering risk within the current analysis time window;

[0030] The risk assessment and alarm module is used to perform correlation analysis based on the risk probability, risk type and preset response threshold output by the classifier, and combined with pre-obtained correlation information to generate alarm work orders.

[0031] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0032] This invention provides a method for identifying and preventing tampering of electricity meters based on the BERT model. It combines preprocessed structured data and text data, calculates and obtains feature data based on the structured data, generates a text sequence based on the text data, extracts [CLS] vectors from the text sequence and the BERT model, and fuses the [CLS] vectors with the feature data to obtain a feature vector. By fully utilizing structured data and text data, preprocessing the data based on the BERT model, and finally obtaining the results through a classifier, this invention can more accurately detect and capture hidden tampering methods, providing an effective foundation for subsequent countermeasures against attacks.

[0033] This invention also performs correlation analysis by combining the risk probability, risk type, and preset response threshold output by the classifier with pre-obtained correlation information. This allows for adjustment of the corresponding response threshold based on the correlation information, enabling more accurate adaptation to specific application scenarios and improving the accuracy of alarms. Attached Figure Description

[0034] Figure 1 is a data flow diagram of a meter anti-tampering identification method based on the BERT model provided in Embodiment 1 of the present invention;

[0035] Figure 2 is a schematic diagram of the relationship between the feature extraction and fusion training module of the BERT model in an anti-tampering system for electricity meters based on the BERT model provided in Embodiment 1 of the present invention. Detailed Implementation

[0036] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0037] Example 1

[0038] Please refer to Figure 1. This embodiment introduces a tamper-proof identification method for electricity meters based on the BERT model, including the following steps:

[0039] S100: Collect the original structured and semi-structured data from the electricity meter terminal and store the collected data in a database. The semi-structured data is text data.

[0040] According to one embodiment of the present invention, the system initiates data acquisition tasks according to a set cycle.

[0041] For example, according to one embodiment of the present invention, the collected data is classified and stored. The structured data includes voltage, current, power, energy consumption, power factor, load curve, frozen data, meter reading success rate, and communication status. The semi-structured data includes power outage, voltage loss, overcurrent event records, alarm information, and operation log information.

[0042] S200. The collected structured data and text data are preprocessed. Feature data is calculated based on the structured data, and text sequences are generated based on the text data, thereby forming feature data and text sequences that serve as standard inputs to the BERT model.

[0043] According to one embodiment of the present invention, the preprocessing method includes abnormal data processing. Specifically, this includes removing outliers, missing values, and duplicate values; calibrating for random events according to clock offset; performing piecewise linear interpolation for missing communication terminals; and performing transformer topology verification for negative power anomalies.

[0044] Furthermore, according to one embodiment of the present invention, after abnormal data processing, the structured data is subjected to secondary calculation to obtain characteristic data such as power consumption drop rate, load fluctuation variance, voltage imbalance, abnormal power consumption patterns during specific periods, and frequency of meter reading failures.

[0045] Furthermore, the specific methods for calculating feature data include the following:

[0046] The formula for calculating the power drop rate (anti-short-circuit tampering) is: Power drop rate = (current day's power consumption - actual power consumption) / current day's power consumption; where, if the current power consumption is less than 30% of the current day's power consumption, then the actual power consumption = 0.3 * current day's power consumption, otherwise the actual power consumption = current power consumption.

[0047] The formula for calculating voltage unbalance (detecting phase line damage) is: Voltage unbalance = (maximum three-phase voltage - minimum three-phase voltage) / average three-phase voltage;

[0048] The formula for calculating load fluctuation variance (quantification of abnormal electricity consumption patterns) is: Hourly load percentage = Hourly load / Total hourly load;

[0049] Load fluctuation entropy = Ʃ(-hourly load percentage * log2(hourly load percentage)) / log2(number of loads per hour);

[0050] The formula for calculating the frequency of communication interruptions (suspected device offline) is: Frequency of communication interruptions = Number of failed data collections / Total number of data collections.

[0051] Furthermore, according to one embodiment of the present invention, generating a text sequence based on text data specifically involves: extracting feature words from the text data as tokenization, and generating a text sequence in chronological order based on multiple events / alarms / logs, etc., of a single meter over a period of time, as shown in the following example:

[0052] [CLS] 2025-07-01 08:14:35 Opening incident [SEP] 2025-07-01 09:03:25 Magnetic field interference alarm [SEP] 2025-07-01 09:25:31 Sudden drop in battery power [SEP] ... [SEP].

[0053] [CLS] and [SEP] are special markers in the BERT model.

[0054] In addition, based on the previously extracted feature data, the feature data is embedded and fused with the text sequence to construct the standard input format for the BERT model.

[0055] S300. Feature Extraction and Fusion Training: Adaptive pre-training of the basic BERT model is performed using pre-obtained power sector text. The text sequence is input into the BERT model to extract the [CLS] vector. The feature data of the [CLS] vector are then fused to obtain a feature vector. Based on the fused feature vector, a classifier is trained using the cross-entropy loss function and labeled historical meter data. The trained classifier is used to calculate the probability and type of meter tampering.

[0056] It should be added that, in this embodiment, in addition to performing domain-adaptive pre-training on text in the power field, the BERT model is also fine-tuned for some professional terms and semantics of meter events specific to the power field, which enables the BERT model to better learn content related to meter events.

[0057] For example, during the pre-training process, adding electricity-related tokens such as event codes, time interval markers, and electricity data units to the base BERT model is one way to achieve this.

[0058] Furthermore, based on one embodiment of the present invention, a multi-layer Transformer Encoder is used to learn the deep-level representation of the contextual relevance of each Token in the sequence. The part corresponding to the [CLS] tag in the sequence is extracted as the last layer output vector of the current sequence, which is the overall aggregate representation of the sequence, and the [CLS] vector is output.

[0059] Secondly, in the process of fusing [CLS] vectors and feature data, an attention mechanism is used to enable the model to assign weights to semantic features based on semantic relevance, thereby fusing [CLS] vectors and feature data together to obtain feature vectors.

[0060] Specifically, attention weights The calculation formula is: ;

[0061] in: Represents a text feature query vector. Represents the numerical feature key vector. express transpose, Represents a vector of numerical eigenvalues. Represents the dimension of the key vector. This indicates the distributor in the attention column.

[0062] In this embodiment, based on the fused feature vector, the cross-entropy loss function and labeled historical electricity meter data are used to train the classifier model, and the risk probability and risk type of tampering risk are output. Specifically, the fused feature vector is input into the classifier, and the cross-entropy loss function and labeled historical electricity meter data are used to train the classifier model. That is, the labeled historical electricity meter data is used as the training set, and the trained classifier is used to calculate the probability and type of tampering risk of the electricity meter in the current analysis time window.

[0063] Furthermore, we formulated multiple tasks such as normal, magnetic field interference, open cover, and short circuit, and used the Linear and Softmax functions to build classifiers, and combined the cross-entropy loss function to train the classifier model.

[0064] This also includes shuffling the [CLS] and [SEP] sequences with tokens and continuously training them in a loop during model training; if the number of normal samples is much greater than the number of maliciously tampered samples, the cross-entropy loss function can be extended to multi-class scenarios, and the FocalLoss function can be used to alleviate the gradient dominated by simple samples.

[0065] In addition, local temporal features can be extracted by adding CNN / LSTM in front of the BERT model, and the robustness of the model can be improved by using FGM / PGD adversarial training. This approach can output the probability / type of explanatory tampering risk.

[0066] S400: Based on the risk probability, risk type, and preset response threshold output by the classifier, and combined with the pre-obtained correlation information, perform correlation analysis to generate an alarm work order.

[0067] One specific implementation method involves the following steps:

[0068] 1) Artificially set a "high risk of tampering" probability response threshold.

[0069] 2) Based on the risk probability output by the classifier and the preset threshold, and combined with the association information, perform association analysis.

[0070] 3) Generate alarm work orders for metering points that are determined to be high-risk.

[0071] For example, the associated information includes the meter's geographical location, line loss, and transformer area anomalies, which improves the accuracy of judgment and generates alarm work orders based on metering points that are determined to be high-risk.

[0072] Specifically, in this embodiment, the classifier outputs probabilities and thresholds, and performs correlation analysis based on factors such as the location of the electricity meter, line loss, and transformer area anomalies, and generates alarm work orders. The processing results of the alarm work orders are then fed back to the classifier, allowing it to enter a continuously improving closed loop.

[0073] In addition to the methods described above, in a specific embodiment of the present invention, a validation set can be used to determine the threshold corresponding to the optimal F2-score.

[0074] Secondly, in this embodiment, information such as the geographical location of the electricity meter, line loss, and transformer area anomalies are added to the rules, and the threshold response rules are adjusted in a timely manner based on this information.

[0075] For example, if three meters in the same area simultaneously alarm, the threshold response is adjusted to 0.8 times the set threshold to reduce the risk of missed alarms. If the line loss deviation rate is >50%, the threshold response is adjusted to 0.7 times the set threshold, requiring greater sensitivity in high-line-loss areas. If the meter has a history of tampering last month, the threshold response is adjusted to 0.9 times the set threshold, making it a key focus for Wield monitoring.

[0076] Example 2

[0077] This embodiment provides a meter anti-tampering identification system based on the BERT model, including a data acquisition module, a data preprocessing module, a feature extraction and fusion training module, and a risk judgment and alarm module.

[0078] The data acquisition module is used to acquire massive amounts of electricity meter data, including structured data and text data from the meters.

[0079] The data preprocessing module is used to preprocess the collected data, calculate and obtain feature data, and generate text sequences as input to the BERT model.

[0080] Please refer to Figure 2. The feature extraction and fusion training module is used to extract the [CLS] vector based on the text sequence and the pre-trained BERT model, and fuse the [CLS] vector and feature data to obtain the feature vector. Combining the feature vector, the cross-entropy loss function and labeled historical electricity meter data are used to train the classifier model. The trained classifier is used to calculate the risk probability and risk type of the electricity meter tampering risk within the current analysis time window.

[0081] The risk assessment and alarm module is used to perform correlation analysis based on the probability output by the model and the set threshold, combined with information such as the geographical location of the electricity meter, line loss, and transformer area anomalies, and generate alarm work orders.

[0082] In this embodiment, the work order processing results can also be fed back to the classifier to form a continuous improvement cycle.

[0083] The specific functions of each module described above are explained in the relevant content of the method in Embodiment 1, and will not be repeated here.

[0084] Example 3

[0085] This embodiment provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in Embodiment 1.

[0086] Example 4

[0087] This embodiment provides a computer device, including:

[0088] Memory, used to store computer programs / instructions;

[0089] A processor for executing the computer program / instructions to implement the steps of the method described in Embodiment 1.

[0090] Example 5

[0091] This embodiment provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described in Embodiment 1.

[0092] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

[0093] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0094] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0095] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0096] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this disclosure and not to limit its protection scope. Although this disclosure has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading this disclosure, they can still make various changes, modifications or equivalent substitutions to the specific implementation of the invention, but these changes, modifications or equivalent substitutions are all within the protection scope of the pending claims.

Claims

1. A method for tamper-proof identification of electricity meters based on the BERT model, characterized in that, Includes the following steps: Structured and textual data from the electricity meter terminal are collected. The collected structured and textual data are preprocessed to form feature data and text sequences, which serve as standard inputs to the BERT model, respectively. [CLS] vectors are extracted from the text sequences and the pre-trained BERT model, and the [CLS] vectors and the feature data are fused to obtain a feature vector. The classifier is trained using the cross-entropy loss function and labeled historical electricity meter data, based on the feature vector. The trained classifier is used to calculate the probability and type of tampering risk of the electricity meter within the current analysis time window. Based on the risk probability, risk type, and preset response threshold output by the classifier, and combined with pre-obtained correlation information, correlation analysis is performed to generate an alarm work order.

2. The BERT-based anti-tampering identification method for electricity meters according to claim 1, characterized in that, The step of extracting the [CLS] vector based on the text sequence and the pre-trained BERT model includes: adaptively pre-training the basic BERT model by combining pre-obtained power industry text, and inputting the text sequence into the trained BERT model to extract the [CLS] vector.

3. The BERT-based meter anti-tampering identification method according to claim 1, characterized in that, The structured data includes voltage, current, power, energy consumption, power factor, load curve, frozen data, meter reading success rate, and communication status; the text data includes power outage event records, voltage loss event records, overcurrent event records, alarm information, and operation log information.

4. The BERT-based anti-tampering identification method for electricity meters according to claim 1, characterized in that, The preprocessing of the collected structured and text data includes: handling abnormal data in the structured and text data; performing secondary calculations on the structured data to obtain feature data; and extracting feature words from the text data to generate a text sequence.

5. The BERT-based meter anti-tampering identification method according to claim 4, characterized in that, The characteristic data include: power consumption drop rate, load fluctuation variance, voltage imbalance, and meter reading failure frequency.

6. The BERT-based anti-tampering identification method for electricity meters according to claim 5, characterized in that, The calculation methods for the power descent rate, load fluctuation variance, voltage imbalance, and meter reading failure frequency are as follows: Power descent rate = (current day's power consumption - actual power consumption) / current day's power consumption; where, if the current power consumption is less than 30% of the current day's power consumption, then the actual power consumption = 0.3 * current day's power consumption, otherwise the actual power consumption = current power consumption; Load fluctuation variance = load fluctuation entropy = Ʃ(-hourly load percentage * log2(hourly load percentage)) / log2(hourly load count); where, hourly load percentage = hourly load / total hourly load; Voltage imbalance = (maximum three-phase voltage - minimum three-phase voltage) / average three-phase voltage; Meter reading failure frequency = communication interruption frequency = number of data collection failures / total number of data collections.

7. The BERT-based meter anti-tampering identification method according to claim 4, characterized in that, The abnormal data processing of structured data and text data includes: removing outliers, null values, and duplicate values.

8. The BERT-based method for tamper-proof identification of electricity meters according to claim 2, characterized in that, The text sequence is input into the trained BERT model to extract the [CLS] vector, including: using a multi-layer Transformer Encoder to learn a deep-level representation of the contextual relevance of each token in the text sequence, and outputting the [CLS] vector in the text sequence.

9. The BERT-based anti-tampering identification method for electricity meters according to claim 1, characterized in that, In the process of fusing [CLS] vectors and feature data, an attention mechanism is used to enable the classifier to assign weights to semantic features based on semantic relevance.

10. A BERT-based anti-tampering identification system for electricity meters, characterized in that, include: The system comprises a data acquisition module, a data preprocessing module, a feature extraction and fusion training module, and a risk assessment and alarm module. The data acquisition module is used to collect structured and text data from the electricity meter terminal; The data preprocessing module preprocesses the collected structured data and text data to form feature data and text sequences, which serve as the standard input to the BERT model, respectively. The feature extraction and fusion training module extracts [CLS] vectors based on the text sequences and the pre-trained BERT model, and fuses the [CLS] vectors with the feature data to obtain feature vectors. Combining the feature vectors, the classifier is trained using the cross-entropy loss function and labeled historical electricity meter data. The trained classifier is then used to calculate the probability and type of tampering risk of the electricity meter within the current analysis time window. The risk assessment and alarm module is used to perform correlation analysis based on the risk probability, risk type and preset response threshold output by the classifier, and combined with pre-obtained correlation information to generate alarm work orders.

Images