Power system data anomaly identification and active protection method and system based on deep learning

Abstract

This invention provides a method and system for anomaly identification and proactive protection of power system data based on deep learning, relating to the field of power system security protection technology. The method includes the following steps: collecting measurement data, switch status data, and operating environment data from various nodes of the power system, and preprocessing the data; constructing a spatiotemporal feature consistency verification mechanism based on a generative adversarial network (GAN) architecture that integrates convolutional neural networks (CNN) and long short-term memory networks (LSTM); this invention employs a multimodal generative adversarial network architecture that integrates CNN and LSTM to capture the spatiotemporal joint distribution characteristics of power data, and combines Wasserstein distance to compare the distribution of real and reconstructed data. This effectively detects sophisticated fake data injection attacks that maintain a constant statistical mean, which are difficult to detect using traditional methods, improving anomaly detection accuracy, reducing false positives, and solving the problem of insufficient anomaly identification accuracy in existing technologies.

Description

Technical Field

[0001] This invention relates to the field of power system security protection technology, and in particular to a method and system for power system data anomaly identification and proactive protection based on deep learning. Background Technology

[0002] With the rapid development of smart grids, power systems are gradually transforming towards digitalization, intelligence, and networking. The deployment of numerous measurement devices, monitoring terminals, and communication modules has led to an explosive growth in power system data. The accuracy and integrity of this data directly determine the scientific validity and security of power system dispatch decisions. Currently, power system data anomaly identification mainly employs traditional threshold detection methods, statistical analysis methods, and simple machine learning methods, coupled with passive protection strategies and centralized system architectures. Anomaly identification methods primarily use fixed thresholds or statistical features to identify obvious anomalies in the data. Protection strategies are mostly unified passive responses, and the system architecture is primarily cloud-based centralized processing, responsible for data storage, model calculation, and protection command issuance. Furthermore, some existing technologies attempt to introduce single deep learning models for data anomaly detection, combined with simple graph models to achieve node localization, providing some technical support for power system data security.

[0003] However, existing technologies suffer from several drawbacks. First, anomaly identification accuracy is insufficient. Traditional methods and single deep learning models cannot capture the spatiotemporal distribution characteristics of power data, making it difficult to detect sophisticated spoofing attacks with constant statistical means. Furthermore, they exhibit poor adaptability to topology changes, leading to false alarms and missed alarms. Second, anomaly localization is ambiguous. Existing localization methods cannot adaptively track dynamic changes in the power grid topology, making it difficult to accurately locate the anomaly's starting node and propagation path, causing significant inconvenience for maintenance personnel. Third, interpretability is lacking. Existing anomaly identification models are mostly "black box" models, unable to quantify the contribution of each feature to anomaly judgment, making it difficult for maintenance personnel to understand the root cause of anomalies and impacting decision-making efficiency. Fourth, protection strategies are rigid. Existing passive protection methods cannot achieve precise matching based on anomaly type, severity, and root cause, resulting in delayed protection responses and difficulty in curbing anomaly expansion. Fifth, system real-time performance and reliability are insufficient. Centralized architecture leads to delayed anomaly responses at edge nodes and high data transmission latency, failing to meet the real-time protection requirements of large-scale smart grids. These defects seriously affect the safe and stable operation of the power system, and there is an urgent need for an efficient, accurate, interpretable, and adaptive anomaly identification and active protection technology and system. Therefore, this invention proposes a deep learning-based power system data anomaly identification and active protection method and system to solve the problems existing in the prior art. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a deep learning-based method and system for power system data anomaly identification and proactive protection. It employs a multimodal generative adversarial network architecture that integrates CNN and LSTM to capture the spatiotemporal joint distribution characteristics of power data. By combining Wasserstein distance to compare the distribution of real and reconstructed data, it can effectively detect sophisticated spoofing attacks that maintain a constant statistical mean, which are difficult to detect using traditional methods. This improves anomaly detection accuracy, reduces false positives, and solves the problem of insufficient anomaly identification accuracy in existing technologies.

[0005] To achieve the objectives of this invention, the invention is implemented through the following technical solution: a deep learning-based method for identifying and actively protecting power system data anomalies, comprising the following steps:

[0006] S1: Collect measurement data, switch status data and operating environment data of each node in the power system, and preprocess the data;

[0007] S2: Based on the Generative Adversarial Network (GAN) architecture that integrates Convolutional Neural Network (CNN) and Long Short-Term Memory Network (LSTM), a spatiotemporal feature consistency verification mechanism is constructed to capture the spatiotemporal joint distribution features of data, calculate the Wasserstein distance between the real data distribution and the reconstructed data distribution, and identify abnormal data that does not conform to the physical spatiotemporal correlation.

[0008] S3: Construct a Dynamic Graph Neural Network (GNN) model, update the adjacency matrix in real time based on the switch state data, learn the dynamic association weights between nodes using the graph attention mechanism, quantify the contribution of nodes to the anomaly loss using Shapley values, and locate the anomaly initiation node and propagation path.

[0009] S4: Integrates the SHAP value analysis framework to quantify the contribution of each input feature to anomaly detection, constructs an anomaly propagation path tracking algorithm, generates a visual anomaly report, and supports historical anomaly case matching and retrieval.

[0010] S5: Based on the root cause tracing results of anomalies, anomalies are classified into three categories and three levels. Combined with the zoning protection requirements of the power monitoring system, a hierarchical adaptive active protection strategy is generated and executed.

[0011] S6: Adopts an edge-cloud collaborative architecture to enable the collaborative execution of lightweight tasks on edge nodes and heavy tasks on the cloud, as well as continuous model optimization.

[0012] A further improvement is made in S1, where data preprocessing includes data cleaning, normalization, and missing value imputation. Missing value imputation employs an LSTM-based interpolation algorithm, with the specific formula as follows:

[0013] ,

[0014] in, Fill in the missing values ​​for the i-th node at time t. The weight of the k-th historical data point. Let tk be the historical measurement data of the i-th node, n be the length of the historical data window, and b be the bias term.

[0015] A further improvement is made in S2, where the formula for calculating the Wasserstein distance is:

[0016] ,

[0017] Where W(P,Q) is the Wasserstein distance between the true data distribution P and the reconstructed data distribution Q. Let Q be the set of all joint distributions from the true data distribution P to the reconstructed data distribution Q. For the sample space of real data, To reconstruct the sample space of the data, For real data samples, To reconstruct the data sample, For the sample and Euclidean distance, For joint distribution exist The probability density at that location.

[0018] A further improvement is made in S3, where the formula for calculating the Shapley value is:

[0019] ,

[0020] in, Let be the Shapley value of the i-th node, i.e., the contribution of node i to the abnormal loss; N is the set of all nodes in the power system; S is any subset of nodes that does not include node i; n is the total number of nodes. The anomaly loss function value for the node subset S. Let S∪{i} be the anomaly loss function value of the subset of nodes containing node i.

[0021] A further improvement is made in S5, where the formula for determining the classification and grading of anomalies is:

[0022] ,

[0023] Where L is the anomaly level judgment value; α and β are the anomaly type weight and anomaly degree weight, respectively, α+β=1; T is the anomaly type coefficient, T=1 for equipment failure, T=2 for data interference, and T=3 for external attack; D is the anomaly degree coefficient, D=1 for general level, D=2 for severe level, and D=3 for emergency level; the anomaly level is determined according to the range of L: 1≤L<2 is the general level, 2≤L<3 is the severe level, and 3≤L≤5 is the emergency level.

[0024] A further improvement is made in S6, where the data interaction delay between the edge node and the cloud node satisfies the following formula:

[0025] ,

[0026] in, For total interaction latency, For data transmission latency of 5G+MEC technology, Due to node data processing latency, and .

[0027] A deep learning-based power system data anomaly identification and proactive protection system includes a data acquisition module, a spatiotemporal feature verification module, a topology adaptive positioning module, an interpretable tracing module, a hierarchical protection module, and an edge-cloud collaboration module.

[0028] The data acquisition module collects measurement data, switch status data, and operating environment data from various nodes of the power system and performs preprocessing. The spatiotemporal feature verification module constructs a spatiotemporal feature consistency verification mechanism based on a GAN architecture that integrates CNN and LSTM, and calculates Wasserstein distance to identify abnormal data. The topology adaptive localization module constructs a Dynamic GNN model, updates the adjacency matrix in real time, and uses Shapley values ​​to locate the starting node and propagation path of anomalies. The interpretable tracing module integrates a SHAP value analysis framework, generates a visual anomaly report, and supports historical case retrieval. The hierarchical protection module generates and executes adaptive proactive protection strategies based on anomaly classification and hierarchical results, combined with zonal protection requirements. The edge-cloud collaboration module deploys edge nodes and cloud nodes, and achieves data interaction and model collaborative optimization through 5G+MEC technology.

[0029] Further improvements are made in that: the spatiotemporal feature verification module includes a generator and a discriminator. The generator is composed of a CNN layer and an LSTM layer connected in series. The CNN layer is used to extract the spatial features of the data, and the LSTM layer is used to extract the temporal features of the data. The discriminator adopts a fully connected neural network to distinguish between real data and the reconstructed data output by the generator. Its loss function is related to the Wasserstein distance.

[0030] Further improvements are made in the following aspects: The hierarchical protection module includes an anomaly classification unit, a level determination unit, and a policy generation unit. The anomaly classification unit classifies anomalies into equipment failure, data interference, and external attack categories based on their root causes. The level determination unit is used to calculate the anomaly level. The policy generation unit generates protection policies for different types and levels of anomalies from the data layer, device layer, and network layer, respectively, and adopts differentiated protection measures based on the security level requirements of the production control area and the management information area.

[0031] Further improvements are made in the following aspects: The edge-cloud collaboration module includes edge nodes and cloud nodes. The edge nodes are deployed to perform lightweight tasks such as data preprocessing, real-time anomaly identification, and local protection. The cloud nodes are deployed to perform heavy tasks such as model training, global root cause analysis, strategy optimization, and data storage. The cloud nodes receive real-time data uploaded by each edge node, iteratively optimize the anomaly identification model and protection strategy, and synchronize the optimized model and strategy to all edge nodes, thereby realizing collaborative linkage between the edge and the cloud.

[0032] The beneficial effects of this invention are as follows:

[0033] 1. This invention improves the ability to identify refined anomalies by adopting a multimodal generative adversarial network architecture that integrates CNN and LSTM to capture the spatiotemporal joint distribution characteristics of power data. It combines Wasserstein distance to compare the distribution of real data and reconstructed data, which can effectively detect refined fake data injection attacks that are difficult to detect by traditional methods and maintain the statistical mean. This improves the accuracy of anomaly detection, reduces the false alarm rate, and solves the problem of insufficient anomaly identification accuracy in existing technologies.

[0034] 2. This invention achieves topology-adaptive and precise anomaly localization by constructing a dynamic graph neural network model that can update the adjacency matrix in real time based on the power grid switch status and measurement data. Through graph attention mechanism, it adaptively learns the dynamic association weights between nodes and combines Shapley values ​​to quantify the contribution of nodes to anomaly losses. This allows for precise localization of the anomaly initiation node and propagation path. In scenarios with frequent topology changes, the false alarm rate is reduced by more than 50%, and the localization error is controlled within 5%, solving the problems of poor topology adaptability and ambiguous localization in existing technologies.

[0035] 3. This invention enhances the interpretability of anomaly identification by integrating the SHAP value analysis framework, quantifying the contribution of each input feature to anomaly determination, constructing an anomaly propagation path tracking algorithm, generating a visual report containing information such as anomaly type and confidence level, and supporting historical anomaly case matching and retrieval. It breaks the limitations of the existing "black box" model, helps operation and maintenance personnel quickly understand the root cause of anomalies, make decisions, and improve operation and maintenance efficiency.

[0036] 4. This invention achieves precise proactive protection by proposing a hierarchical adaptive proactive protection strategy. Anomalies are classified into three categories and three levels based on their root causes, achieving precise matching between "anomaly type-anomaly degree-root cause" and protective measures. Differentiated protection measures are adopted in conjunction with the requirements of zoned protection, which improves the protection response speed, effectively curbs the expansion of anomalies, reduces the operational risks of the power system, and solves the problems of rigidity and delayed response of existing protection strategies.

[0037] 5. This invention improves the real-time performance and reliability of the system by designing a distributed system architecture that integrates edge and cloud. Lightweight tasks are deployed on edge nodes and heavy tasks are deployed on the cloud. Real-time data interaction and model optimization are achieved through 5G+MEC technology, reducing system response latency to less than 50ms, improving reliability, and adapting to the application scenarios of large-scale smart grids. This invention solves the problems of poor real-time performance and insufficient reliability of existing centralized systems. Attached Figure Description

[0038] Figure 1 This is a flowchart of the method of the present invention;

[0039] Figure 2 This is a schematic diagram of the system of the present invention. Detailed Implementation

[0040] To enhance understanding of the present invention, the present invention will be further described in detail below with reference to embodiments. These embodiments are only used to explain the present invention and do not constitute a limitation on the scope of protection of the present invention.

[0041] Example 1

[0042] according to Figure 1 , 2 As shown, this embodiment proposes a method and system for power system data anomaly identification and proactive protection based on deep learning. Specifically, for the scenario of refined spoofing attack detection in power systems, a spatiotemporal feature consistency verification mechanism based on a GAN architecture fusing CNN and LSTM is implemented, with the following steps:

[0043] Data Acquisition and Preprocessing: Measurement data (including voltage, current, power, etc.) from 500 nodes of a provincial smart grid were collected at a sampling frequency of 1 minute / time for 30 days. At the same time, the switch status data of each node were collected. After excluding obviously abnormal data (such as data exceeding the rated range of the equipment), the missing values ​​were filled by LSTM interpolation algorithm. The historical data window length n=10, the weight wk was obtained by gradient descent algorithm, and the bias term b=0.02. Then, the data was normalized and mapped to the interval [0,1] to obtain the preprocessed dataset, which was divided into training set (70%), validation set (15%) and test set (15%).

[0044] GAN Architecture Construction: The generator consists of 3 CNN layers and 2 LSTM layers. The CNN layers use 3×3 convolutional kernels with 32, 64, and 128 kernels respectively, used to extract spatial correlation features of measurement data from different nodes. The LSTM layers have 256 hidden neurons and a dropout coefficient of 0.3, used to extract time-series features of continuous time-series data. The generator's output is reconstructed data with the same dimension as the input data. The discriminator uses a 3-layer fully connected neural network. The input is real data or reconstructed data, and the output is a data authenticity score (0~1). The loss function is Wasserstein loss, combined with gradient clipping (clipping range [-0.01, 0.01]) to avoid model training instability.

[0045] Model Training and Validation: The training set is input into the GAN model for training. The training epochs are 100, the batch size is 64, the learning rate is 0.0002, and the Adam optimizer is used. During training, model parameters are adjusted using the validation set to ensure the model's generalization ability. After training, the test set is input into the generator to obtain reconstructed data. The Wasserstein distance formula is used to calculate the distance between the real data distribution P and the reconstructed data distribution Q. A distance threshold of 0.05 is set. When the calculated Wasserstein distance is greater than the threshold, it is determined that there is anomalous data (refined fake data injection attack).

[0046] Test Results: In this test, 100 sets of refined fake data with the statistical mean unchanged were injected into the test set (injection ratio of 5%). The traditional threshold detection method only detected 32 sets, with a detection accuracy of 32%. The spatiotemporal feature consistency verification mechanism of this embodiment detected 95 sets, with a detection accuracy of 95% and a false negative rate of 5%, which is a significant improvement over the traditional method, verifying the effectiveness of the mechanism.

[0047] Example 2

[0048] according to Figure 1 , 2 As shown, this embodiment proposes a method and system for power system data anomaly identification and proactive protection based on deep learning. For scenarios involving frequent changes in power system topology (topology adjustments due to switching operations and equipment maintenance), a topology adaptive anomaly localization method based on dynamic GNN is implemented. The specific steps are as follows:

[0049] Data preparation: The measurement data and switch status data of 500 nodes collected in Example 1 are used to simulate the topology change scenario (the switch status of 10 nodes is randomly adjusted every hour to simulate equipment maintenance, line switching and other scenarios). At the same time, at the 100th hour, a data interference anomaly (simulating data deviation caused by sensor failure) is injected into the 25th node. The anomaly lasts for 2 hours.

[0050] Dynamic GNN model construction: The model input consists of measurement data and switch state data of each node. The initial value of the adjacency matrix is ​​set according to the original topology of the power grid. When the switch state changes, the adjacency matrix is ​​updated in real time (the adjacency weight between the corresponding nodes is set to 1 when the switch is closed and 0 when the switch is open). The model adopts a graph attention layer (GAT) with 4 attention heads and 128 hidden layer dimensions to adaptively learn the dynamic association weights between different nodes and output the feature representation of each node.

[0051] Anomaly localization process: When the system detects an anomaly (through the spatiotemporal feature consistency verification mechanism in Example 1), the anomaly loss function is calculated through backpropagation. The Shapley value formula is used to quantify the contribution of each node to the anomaly loss. The total number of nodes is n=500. The anomaly loss function v(S) adopts the mean squared error loss. The Shapley value of each node is calculated. The Shapley values ​​are sorted, and the top 5 nodes are selected as anomaly candidate nodes. Combining the power grid topology and propagation law, the anomaly starting node and propagation path are located.

[0052] Test results: Traditional localization methods have a false alarm rate of 38% in topology change scenarios and cannot accurately locate the starting node of the anomaly. The dynamic GNN localization method in this embodiment has a false alarm rate of 12%, successfully locates the 25th starting node of the anomaly, and accurately tracks the propagation path of the anomaly to the 24th, 26th, 30th and 35th nodes with a localization error of 3%, which verifies the accurate localization capability of the method in topology change scenarios.

[0053] Example 3

[0054] according to Figure 1 , 2 As shown, this embodiment proposes a method and system for power system data anomaly identification and proactive protection based on deep learning. Addressing the issues of poor interpretability of anomaly tracing and low efficiency in operation and maintenance decision-making, an interpretable anomaly tracing analysis scheme is implemented. The specific steps are as follows:

[0055] Source tracing model construction: Integrating the SHAP value analysis framework, the outputs of the GAN model in Example 1 and the dynamic GNN model in Example 2 are used as inputs to quantify the contribution of each input feature (voltage, current, power, switching state, etc.) to anomaly detection. The SHAP value is calculated using the following formula:

[0056] ,

[0057] in, Let be the Shapley value of the i-th node, i.e., the contribution of node i to the abnormal loss; N is the set of all nodes in the power system; S is any subset of nodes that does not include node i; n is the total number of nodes. The anomaly loss function value for the node subset S. Let S∪{i} be the anomaly loss function value of the subset of nodes containing node i.

[0058] The number of features is 8 (4 types of measurement data + 4 types of switch status data for each node).

[0059] Anomaly propagation path tracing: An anomaly propagation path tracing algorithm based on graph neural networks is constructed. Starting from the anomaly initiation node, the anomaly propagation probability is calculated based on the dynamic association weights between nodes (from the dynamic GNN model in Example 2). The formula is as follows: ,in Let be the probability that an anomaly propagates from node i to node j. The dynamic association weight between nodes i and j is denoted by N(i), and N(i) is the set of neighboring nodes of node i. When the propagation probability is greater than 0.6, it is determined to be an abnormal propagation path.

[0060] Visualized Reports and Case Retrieval: Generates visualized anomaly reports, including anomaly type (data interference), confidence level (96%), key features (current data at node 25, SHAP value of 0.82, highest contribution), possible causes (sensor failure), and recommended actions (repair and calibrate the sensor at node 25); Builds a historical anomaly case database, storing 500 anomaly cases from the past year, including anomaly type, root cause, and handling measures, supporting matching and retrieval based on the key features of the current anomaly, and quickly accessing handling experience from similar cases.

[0061] Operation and maintenance testing: Ten power operation and maintenance personnel were invited to conduct root cause analysis and decision-making on 20 anomaly cases using both traditional tracing methods and the interpretable tracing method of this embodiment. The traditional method had an average decision-making time of 45 minutes and a decision-making accuracy rate of 68%; the method of this embodiment had an average decision-making time of 18 minutes and a decision-making accuracy rate of 92%, significantly improving the efficiency and accuracy of operation and maintenance decision-making.

[0062] Example 4

[0063] according to Figure 1 , 2 As shown in the figure, this embodiment proposes a method and system for power system data anomaly identification and proactive protection based on deep learning. Addressing the problems of rigid protection strategies and mismatch with abnormal scenarios, a hierarchical adaptive proactive protection strategy is implemented. The specific steps are as follows:

[0064] Anomaly Classification and Grading: Based on the root cause tracing results (from Example 3), anomalies are classified into three categories: equipment failure (e.g., sensor failure, equipment aging), data interference (e.g., measurement data deviation, transmission interference), and external attack (e.g., spoofed data injection, intrusion attack); each category is further divided into three levels, using the formula... The determination is made, where α=0.4 and β=0.6. For example, for external attack type (T=3) and emergency level (D=3), L=0.4×3+0.6×3=3, and it is determined to be an emergency level abnormality.

[0065] Protection strategy generation: Differentiated protection strategies are generated for different types and levels of anomalies: (1) Equipment failure: General level (L=1~2), equipment parameter adjustment and regular inspection are adopted; Severe level (L=2~3), equipment shutdown and maintenance and backup equipment switching are adopted; Emergency level (L=3~5), emergency shutdown and fault isolation are adopted to prevent the spread of the fault. (2) Data interference: General level, abnormal data isolation and data correction are adopted; Severe level, data recovery and transmission link inspection are adopted; Emergency level, data encryption transmission and interference source location and removal are adopted. (3) External attack: General level, intrusion detection and access control are adopted; Severe level, encryption authentication and attack interception are adopted; Emergency level, network isolation and system restart are adopted to cut off the attack path. At the same time, in combination with the power monitoring system zoning protection requirements, the production control area adopts high-strength encryption and strict access control, and the management information area adopts conventional protection and data desensitization processing.

[0066] Protection Strategy Implementation and Testing: Three different types and levels of abnormal scenarios were simulated: Scenario 1, General level of equipment failure (sensor parameter drift); Scenario 2, Severe level of data interference (data distortion caused by transmission link interference); Scenario 3, Emergency level of external attack (spoofed data injection attack). Traditional passive protection strategies employ a uniform "data isolation + alarm" measure for all three scenarios, with an average protection response time of 120 seconds and an anomaly escalation rate of 28%. The hierarchical adaptive protection strategy in this embodiment achieves the following results: Scenario 1 response time is 30 seconds with no anomaly escalation; Scenario 2 response time is 60 seconds with an anomaly escalation rate of 5%; Scenario 3 response time is 15 seconds with no anomaly escalation. The protection response speed is improved by 62.5% compared to traditional methods, and the anomaly escalation rate is reduced by 82.1%.

[0067] Example 5

[0068] according to Figure 1 , 2 As shown, this embodiment proposes a method and system for power system data anomaly identification and proactive protection based on deep learning. Addressing the issues of poor real-time performance and insufficient reliability in centralized systems, it implements an edge-cloud collaborative distributed system architecture. The specific steps are as follows:

[0069] System architecture deployment: The entire power system is divided into 10 edge nodes (each edge node is responsible for data processing of 50 power nodes) and 1 cloud node. The edge nodes adopt industrial-grade edge computing gateways and deploy lightweight tasks such as data preprocessing, real-time anomaly identification (a simplified version of the spatiotemporal feature consistency verification mechanism in Example 1), and local protection execution (a simplified version of the protection strategy in Example 4). The cloud node adopts a cloud server cluster and deploys heavy tasks such as model training, global root cause analysis (a complete version of the source analysis in Example 3), strategy optimization, and data storage. The edge nodes and the cloud node are connected through 5G+MEC technology, with a data transmission rate of ≥1Gbps and a transmission latency of ≤30ms.

[0070] Collaborative workflow: (1) Edge nodes collect data from 50 local nodes, perform preprocessing and real-time anomaly identification. If a general level anomaly is detected, the local protection strategy is executed directly, and the anomaly information is uploaded to the cloud. If a severe or emergency level anomaly is detected, local emergency protection measures are executed immediately, and the anomaly data and preliminary analysis results are uploaded to the cloud. (2) Cloud nodes receive data uploaded by each edge node, perform global root cause analysis, optimize the anomaly identification model and protection strategy, and synchronize the optimized model and strategy to each edge node to achieve iterative updates of the model. (3) Cloud nodes are responsible for data storage (storing 3 years of measurement data, anomaly data, protection records, etc.), supporting historical data query and statistical analysis, and providing data support for operation and maintenance decisions.

[0071] System performance testing: Comparing the centralized architecture with the edge-cloud collaborative architecture of this embodiment, the test indicators include system response latency, reliability, and scalability: (1) Response latency: The average response latency of the centralized architecture is 180ms, and the average response latency of the edge-cloud collaborative architecture is 42ms, which meets the requirements. Requirements; (2) Reliability: Simulating the failure of 5 edge nodes, the centralized architecture is paralyzed as a whole, and the reliability is 0; In the edge-cloud collaborative architecture, the tasks of the failed edge node are temporarily taken over by the adjacent edge node, and the system can still run normally, with a reliability of 95%; (3) Scalability: Adding 200 power nodes, the centralized architecture needs to expand the cloud server, and the expansion time is 24 hours; The edge-cloud collaborative architecture only needs to add 4 edge nodes, and the expansion time is 2 hours, which significantly improves scalability and adapts to the application requirements of large-scale smart grids.

[0072] Validation data:

[0073] The present invention, through testing five embodiments and combining performance indicators of existing technologies, yielded summary data, as shown in the table below:

[0074]

[0075] As can be seen from the above data, the present invention has significantly improved upon existing technologies in terms of anomaly detection accuracy, positioning accuracy, operation and maintenance efficiency, protection response speed, and system reliability. It can effectively solve many defects of existing technologies and is suitable for the security protection needs of large-scale smart grids.

[0076] This invention enhances the ability to identify refined anomalies by employing a multimodal generative adversarial network architecture that integrates CNN and LSTM. It captures the spatiotemporal joint distribution characteristics of power data and uses Wasserstein distance to compare the distribution of real and reconstructed data. This effectively detects sophisticated spoofing attacks that maintain a constant statistical mean, which are difficult to detect using traditional methods. The anomaly detection accuracy is improved by more than 30% compared to traditional methods, and the false negative rate is reduced by more than 40%, solving the problem of insufficient anomaly identification accuracy in existing technologies. This invention also achieves topology-adaptive and precise anomaly localization by constructing a dynamic graph neural network model that updates the adjacency matrix in real time based on grid switch status and measurement data. Through a graph attention mechanism, it adaptively learns the dynamic association weights between nodes and combines Shapley values ​​to quantify the contribution of nodes to anomaly losses. This allows for precise localization of the anomaly's initiation node and propagation path. In scenarios with frequent topology changes, the false positive rate is reduced by more than 50%, and the localization error is controlled within 5%, solving the problems of poor topology adaptability and ambiguous localization in existing technologies. This invention enhances the interpretability of anomaly identification by integrating the SHAP value analysis framework to quantify the contribution of each input feature to anomaly judgment, constructing an anomaly propagation path tracking algorithm, generating a visual report containing information such as anomaly type and confidence level, and supporting historical anomaly case matching and retrieval. It breaks through the limitations of existing "black box" models, helping maintenance personnel quickly understand the root causes of anomalies and make decisions, improving maintenance efficiency by over 60%. This invention achieves precise proactive protection by proposing a hierarchical adaptive proactive protection strategy. Anomalies are classified into three categories and three levels based on their root causes, achieving precise matching between "anomaly type-anomaly degree-root cause" and protective measures. Combined with zoned protection requirements, differentiated protection measures are adopted, improving the protection response speed by over 60% compared to traditional passive protection. This effectively curbs anomaly escalation, reduces power system operational risks, and solves the problems of rigidity and delayed response in existing protection strategies. This invention improves system real-time performance and reliability by designing an edge-cloud collaborative distributed system architecture. Lightweight tasks are deployed on edge nodes, while heavyweight tasks are deployed in the cloud. Real-time data interaction and model optimization are achieved through 5G+MEC technology, reducing system response latency to less than 50ms and improving reliability by over 70%. This makes the system suitable for large-scale smart grid applications and solves the problems of poor real-time performance and insufficient reliability in existing centralized systems.

[0077] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention.

Claims

1. A method for power system data anomaly identification and proactive protection based on deep learning, characterized in that, Includes the following steps: S1: Collect measurement data, switch status data, and operating environment data from various nodes of the power system. Preprocess the data, including data cleaning, normalization, and missing value imputation. Missing value imputation uses an LSTM-based interpolation algorithm, with the specific formula as follows: ， in, Fill in the missing values ​​for the i-th node at time t. The weight of the k-th historical data point. For the historical measurement data of the i-th node at time tk, n is the length of the historical data window, and b is the bias term; S2: Based on a Generative Adversarial Network (GAN) architecture that integrates Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM), a spatiotemporal feature consistency verification mechanism is constructed to capture the spatiotemporal joint distribution features of data. The Wasserstein distance between the real data distribution and the reconstructed data distribution is calculated to identify anomalous data that does not conform to physical spatiotemporal correlation. The formula for calculating the Wasserstein distance is: ， Where W(P,Q) is the Wasserstein distance between the true data distribution P and the reconstructed data distribution Q. Let Q be the set of all joint distributions from the true data distribution P to the reconstructed data distribution Q. For the sample space of real data, To reconstruct the sample space of the data, For real data samples, To reconstruct the data sample, For the sample and Euclidean distance, For joint distribution exist The probability density at that location; S3: Construct a Dynamic Graph Neural Network (GNN) model, update the adjacency matrix in real time based on switch state data, learn the dynamic association weights between nodes using a graph attention mechanism, and quantify the contribution of nodes to the anomaly loss using the Shapley value to locate the anomaly initiation node and propagation path. The formula for calculating the Shapley value is: ， in, Let be the Shapley value of the i-th node, i.e., the contribution of node i to the abnormal loss; N is the set of all nodes in the power system; S is any subset of nodes that does not include node i; n is the total number of nodes. The anomaly loss function value for the node subset S. Let S∪{i} be the anomaly loss function value of the subset of nodes containing node i; S4: Integrates the SHAP value analysis framework to quantify the contribution of each input feature to anomaly detection, constructs an anomaly propagation path tracking algorithm, generates a visual anomaly report, and supports historical anomaly case matching and retrieval. S5: Based on the root cause analysis results, anomalies are classified into three categories and three levels. Combined with the zoning protection requirements of the power monitoring system, a hierarchical adaptive active protection strategy is generated and executed. The formula for determining the anomaly classification and level is as follows: ， Where L is the anomaly level judgment value; α and β are the anomaly type weight and anomaly degree weight, respectively, α+β=1; T is the anomaly type coefficient, T=1 for equipment failure, T=2 for data interference, and T=3 for external attack; D is the anomaly degree coefficient, D=1 for general level, D=2 for severe level, and D=3 for emergency level; the anomaly level is determined according to the range of L: 1≤L<2 is the general level, 2≤L<3 is the severe level, and 3≤L≤5 is the emergency level. S6: Adopts an edge-cloud collaborative architecture to achieve collaborative execution of lightweight tasks on edge nodes and heavy tasks on the cloud, as well as continuous model optimization. The data interaction latency between edge nodes and cloud nodes satisfies the following formula: ， in, For total interaction latency, For data transmission latency of 5G+MEC technology, Due to node data processing latency, and .

2. A deep learning-based power system data anomaly identification and active protection system, applied to the deep learning-based power system data anomaly identification and active protection method described in claim 1, characterized in that: It includes a data acquisition module, a spatiotemporal feature verification module, a topology adaptive positioning module, an interpretable traceability module, a hierarchical protection module, and an edge-cloud collaboration module; The data acquisition module is used to collect measurement data, switch status data and operating environment data of each node of the power system and perform preprocessing; the spatiotemporal feature verification module is based on the GAN architecture that integrates CNN and LSTM to build a spatiotemporal feature consistency verification mechanism and calculate Wasserstein distance to identify abnormal data. The topology adaptive localization module constructs a Dynamic GNN model, updates the adjacency matrix in real time, and uses Shapley values ​​to locate the anomaly initiation node and propagation path; the interpretable tracing module integrates the SHAP value analysis framework, generates a visual anomaly report, and supports historical case retrieval; the hierarchical protection module generates and executes an adaptive proactive protection strategy based on the anomaly classification and hierarchical results and the partitioned protection requirements; the edge-cloud collaboration module deploys edge nodes and cloud nodes, and uses 5G+MEC technology to achieve data interaction and model collaborative optimization.

3. The deep learning-based power system data anomaly identification and active protection system according to claim 2, characterized in that: The spatiotemporal feature verification module includes a generator and a discriminator. The generator is composed of a CNN layer and an LSTM layer connected in series. The CNN layer is used to extract the spatial features of the data, and the LSTM layer is used to extract the temporal features of the data. The discriminator uses a fully connected neural network to distinguish between real data and the reconstructed data output by the generator, and its loss function is related to the Wasserstein distance.

4. The deep learning-based power system data anomaly identification and active protection system according to claim 2, characterized in that: The hierarchical protection module includes an anomaly classification unit, a level determination unit, and a policy generation unit. The anomaly classification unit classifies anomalies into equipment failure, data interference, and external attack categories based on their root causes. The level determination unit calculates the anomaly level. The policy generation unit generates protection policies for different types and levels of anomalies from the data layer, equipment layer, and network layer, respectively, and adopts differentiated protection measures based on the security level requirements of the production control area and the management information area.

5. The deep learning-based power system data anomaly identification and active protection system according to claim 2, characterized in that: The edge-cloud collaboration module includes edge nodes and cloud nodes. The edge nodes are equipped with lightweight tasks such as data preprocessing, real-time anomaly identification, and local protection. The cloud nodes are equipped with heavyweight tasks such as model training, global root cause analysis, policy optimization, and data storage. The cloud nodes receive real-time data uploaded by each edge node, iteratively optimize the anomaly identification model and protection policy, and synchronize the optimized model and policy to all edge nodes to achieve collaborative linkage between the edge and the cloud.

Images