Electric power measurement data security risk assessment method and device

Abstract

The invention discloses an electric power measurement data security risk assessment method and device, and belongs to the technical field of electric power system data security. The method comprises the following steps: collecting multi-source data of a metering core, scene dynamics and equipment health, and constructing a high-dimensional feature matrix through standardization processing; constructing a dynamic risk assessment model fusing scene feature statistical distribution and an equipment health attenuation rule, and dynamically updating a prior probability and a likelihood function; a GARCH-LSTM improved model and a Markov chain are combined to realize risk value prediction and evolution deduction; and outputting a grading prevention and control strategy based on the risk value confidence interval and the conduction probability, and optimizing model parameters through grid search. The device adopts a modular design and adapts to multi-scene deployment. According to the invention, the dynamic accuracy of risk assessment and prevention and control perspectiveness can be improved, and the security event loss and the operation and maintenance cost are reduced.

Description

Technical Field

[0001] This invention belongs to the field of power system data security technology, specifically relating to a method and apparatus for assessing the security risks of power metering data. Background Technology

[0002] With the construction of new power systems and the deepening of power market reforms, electricity metering data has become a core foundation for grid security dispatch, fair electricity trading, and user electricity consumption behavior analysis. Its security and reliability are directly related to the stable operation of the power system. Currently, the power system is continuously expanding in scale, with a large number of distributed renewable energy sources being connected and diversified loads fluctuating randomly. This has resulted in electricity metering data exhibiting massive growth and dynamic changes. At the same time, the security threats faced by data throughout the entire process of collection, transmission, storage, and application are becoming increasingly complex, such as data tampering, packet loss during transmission, metering deviations caused by hardware aging, and cross-node risk diffusion. These issues place higher demands on electricity metering data security risk assessment technology.

[0003] Current methods for assessing the security risks of power metering data often employ fixed thresholds or static models, failing to fully consider the dynamic characteristics of power systems, such as power fluctuations caused by distributed renewable energy access and the differentiated characteristics of different terminal loads. This makes it difficult for assessment results to adapt to the risk identification needs of complex scenarios, and easily leads to misjudgments or omissions. Furthermore, traditional solutions mainly respond passively to security risks, lacking proactive prediction capabilities, and are difficult to meet the needs of forward-looking security prevention and control of power systems. Summary of the Invention

[0004] In view of the technical problems mentioned in the background section, the purpose of this invention is to provide a method and apparatus for assessing the security risks of power metering data.

[0005] To achieve the objectives of this invention, the technical solution provided by this invention is as follows: First aspect This invention provides a method for assessing the security risks of electricity metering data, comprising the following steps: Step 1: Collect multi-source power metering data of distribution nodes or transformer substations within the target area and construct a high-dimensional feature matrix; Step 2: Quantify the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment respectively; based on the quantification results, construct a dynamic risk assessment model that integrates the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment; dynamically update the prior probability and likelihood function of the dynamic risk assessment model. Step 3: Input the high-dimensional feature matrix into the dynamic risk assessment model, combine the improved LSTM time series prediction model and Markov chain state transition algorithm to predict the probability distribution of risk values, obtain the confidence interval of risk values, and deduce the risk evolution trend to obtain the risk transmission probability. Step 4: Based on the confidence interval of the risk value and the risk transmission probability, output the hierarchical prevention and control strategy and the iterative optimization instructions for model parameters.

[0006] Further, in step 1, the multi-source data for power metering includes core metering data, dynamic characteristic data of the scenario, and equipment health status data; the core metering data includes the effective value of the three-phase current at the node, the effective value of the three-phase voltage at the node, total active power, total reactive power, power factor, and total harmonic distortion rate; the dynamic characteristic data of the scenario includes the distributed photovoltaic access power, the distributed wind power access power, the penetration rate of new energy, the proportion of industrial / residential / commercial / public load, the load fluctuation rate during the time period, and the peak-valley load ratio; the equipment health status data includes the cumulative running time of the metering equipment, the remaining days of the calibration cycle, the deviation value of the last calibration, the real-time operating temperature, the internal humidity of the equipment, the cumulative number of faults, and the sensor drift.

[0007] Furthermore, in step 1, the process of constructing the high-dimensional feature matrix specifically includes the following: Step 1.1: Standardize the multi-source power metering data using Z-score standardization to obtain the first multi-source power metering data; Step 1.2: For the first power metering multi-source data, outliers are identified and removed using the 3σ criterion, and missing values ​​are filled in using the K-nearest neighbor interpolation method to obtain the second power metering multi-source data; Step 1.3: Arrange the second power metering multi-source data in the order of core metering data, scenario dynamic feature data, and equipment health status data. Each data sample forms a feature vector for a single sample. Stack all the feature vectors of the samples row by row to integrate them into a high-dimensional feature matrix. ,in, m The number of valid samples collected. n is the total number of features in the high-dimensional feature matrix.

[0008] Furthermore, in step 2, the step of quantifying the statistical distribution pattern of the scene characteristics of distribution nodes or transformer areas specifically includes: fitting the statistical distribution of the scene dynamic characteristic data using a Gaussian mixture model, determining the number of model components using the Bayesian information criterion, and obtaining different risk levels. R Scene dynamic feature data probability density function ; The steps for quantifying the health degradation patterns of metering equipment specifically include: calculating the equipment health index. H The formula is as follows: ; in, The number of feature dimensions for the device health status data; For the first i Standardized statistics for health status data of various types of equipment; For the first i The statistical control threshold for the 95% confidence level of health-related data is determined based on the quantiles of historical health status data. The slope of the sigmoid function is obtained by fitting the correlation data between historical health status indicators and actual failure occurrences using the least squares method. The fitting objective is to minimize the mean square error between the predicted health status and the actual health status. The cumulative attenuation coefficient is fitted based on historical data of equipment performance degradation after a fault; For the first j The relative percentage of runtime following each failure is a statistical measure. This represents the cumulative number of faults.

[0009] Furthermore, in step 2, the dynamic risk assessment model is a probabilistic assessment model that integrates multi-source features, including: The input layer is used to receive high-dimensional feature matrices; Feature fusion layer, used to combine high-dimensional feature matrix with device health index H Different risk levels R Scene dynamic feature data S probability density function By performing correlation and integration, a comprehensive feature is obtained that combines multi-source scene features and device health status; The probability output layer outputs the posterior probability distribution of the risk level based on the comprehensive features of multi-source scene features and device health status.

[0010] Furthermore, in step 2, the prior probabilities of the dynamic risk assessment model are dynamically updated, specifically including the following: Combined with different risk levels R Scene dynamic feature data S probability density function Equipment health index H The posterior probability is calculated using the Bayesian posterior update formula and then updated to the prior probability of risk assessment; wherein the Bayesian posterior update formula is: ; in, To combine equipment health index and scene dynamic feature data Post-risk level R The posterior probability; Risk level R The likelihood function of the Beta distribution of the device health index. For different risk levels Scene dynamic feature data The probability density function; Risk level The initial prior probability; The variable is an integral dummy variable, representing the risk level. Iterate through and retrieve values; The likelihood function of the dynamic risk assessment model is updated dynamically, specifically including the following: Based on the correlation data between historical high-dimensional feature matrices and corresponding risk levels, a multidimensional normal distribution of the high-dimensional feature matrices under different risk levels R is fitted to obtain the likelihood function. Let be the probability density function of this multidimensional normal distribution, as shown in the following formula: ; Where n is the feature dimension of the high-dimensional feature matrix. Risk level R The mean vector of the high-dimensional features. Risk level R The covariance matrix of the high-dimensional features. for The inverse matrix; T denotes the matrix inversion; The probability output layer is fused , and Output the posterior probability distribution of the risk level.

[0011] Furthermore, step 3 specifically includes the following: An improved LSTM time series prediction model integrating GARCH volatility modeling is adopted. The volatility characteristics of electricity metering data captured by the GARCH model are incorporated into the input layer of the LSTM model. Combined with the output of the dynamic risk assessment model, the probability distribution prediction of the risk value is completed, and its mathematical expectation and standard deviation statistical characteristics are extracted. Combined with the preset confidence level, the confidence interval of the risk value is calculated. Based on the historical transfer records of risk levels, the transfer frequency between each risk level is statistically analyzed. After Laplace smoothing, a state transition matrix is ​​constructed using the Markov chain state transition algorithm. Combined with the output of the dynamic risk assessment model, the risk evolution trend is deduced, and the risk transmission probability is obtained through quantitative calculation. Wherein, the risk transmission probability The calculation formula is as follows: ; in, Number of timing windows Step state transition matrix, The current risk level is... The risk level is higher than the current level. for k Step inside from Transfer to The probability of; Wherein, the risk value The calculation formula is as follows, which is derived by fusing the statistical characteristics of the probability distribution: ; in, The mathematical expectation of the risk value, Let be the coefficient of variation of the risk distribution. These are the weighting coefficients.

[0012] Furthermore, in step 4, the output logic of the tiered prevention and control strategy is as follows: Based on the upper limit of the 95% confidence interval of the risk value and the risk transmission probability, the risk is divided into three levels: low risk, medium risk, and high risk. For low-risk levels, the upper limit of the risk value confidence interval is ≤0.3 and the risk transmission probability is <10%. Conventional monitoring strategies are adopted, and multi-source power metering data are collected according to the original preset collection cycle and the dynamic risk assessment model is verified. For medium-risk levels, the upper limit of the risk value confidence interval is 0.3-0.7 and the risk transmission probability is ≥10% and <30%. An enhanced monitoring strategy is adopted, shortening the data collection cycle to 50% of the original preset collection cycle, and simultaneously launching a special investigation of equipment health status data. For high-risk levels, the upper limit of the risk value confidence interval is >0.7 and the risk transmission probability is ≥30%. Emergency prevention and control strategies are adopted, such as suspending the settlement of metering data at this node and triggering offline calibration or replacement procedures for the equipment. If the upper limit of the risk value confidence interval and the risk transmission probability do not meet the dual conditions required for either of the above levels, the prevention and control strategy shall be implemented according to the higher level of the risk levels corresponding to the two indicators.

[0013] Furthermore, in step 4, the process of outputting the model parameter iterative optimization instruction is as follows: If the number of newly collected multi-source power metering data reaches the preset number, a parameter iteration is triggered. A grid search algorithm is used to optimize the parameters of the covariance matrix weights of the dynamic risk assessment model, the smoothing coefficients of the Markov chain state transition algorithm, and the learning rate of the improved LSTM time series prediction model. The core indicators are the KS value and the PSI value of the dynamic risk assessment model prediction results. The KS value is the discrimination index of the model prediction results after separating the high-risk level from the three risk levels and merging the low-risk and medium-risk levels into a non-high-risk level. The target threshold of the KS value is ≥0.4 and the target threshold of the PSI value is <0.1. If no combination that simultaneously satisfies KS≥0.4 and PSI<0.1 is found after traversing all parameter combinations, the combination with the KS value closest to 0.4 and the PSI value closest to 0.1 is selected as the suboptimal solution. The parameter range corresponding to this combination is expanded outward by a preset magnitude while keeping the step size unchanged, and the grid search is re-executed once. The optimized parameters are fed back to the dynamic risk assessment model and the improved LSTM time series prediction model to achieve adaptive model updates.

[0014] Second aspect This invention provides a power metering data security risk assessment device for performing the power metering data security risk assessment method, the device comprising: The matrix construction module is used to collect multi-source power metering data of distribution nodes or transformer areas within the target area and construct a high-dimensional feature matrix. The model building module is used to quantify the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment, respectively; based on the quantification results, a dynamic risk assessment model integrating the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment is constructed; and the prior probability and likelihood function of the dynamic risk assessment model are dynamically updated. The confidence interval and risk transmission probability calculation module is used to input the high-dimensional feature matrix into the dynamic risk assessment model, combine the improved LSTM time series prediction model and Markov chain state transition algorithm to predict the probability distribution of risk values, obtain the confidence interval of risk values, and perform risk evolution trend deduction to obtain the risk transmission probability. The prevention and control strategy output and parameter optimization module is used to output hierarchical prevention and control strategies and model parameter iterative optimization instructions based on the confidence interval of the risk value and the risk transmission probability.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention integrates the statistical distribution of scenario features with the health degradation law of equipment through a dynamic risk assessment model, and combines iterative parameter optimization mechanism to solve the shortcomings of traditional assessment methods that rely on static assumptions and fail to adapt to scenario changes and equipment aging. The model's prior probability fluctuates with the scenario and the equipment status is updated in real time. At the same time, the parameters are continuously optimized through grid search, which improves the matching degree between the risk assessment results and the dynamic characteristics of actual power metering data, and improves the accuracy of the assessment. In addition, the combination of GARCH-LSTM time series prediction and Markov chain evolution deduction can not only output the point prediction results of risk values, but also quantify the risk transmission probability. At the same time, the hierarchical prevention and control based on the dual basis of risk value confidence interval and risk transmission probability avoids the misjudgment problem of traditional single threshold strategy. Low-risk scenarios save monitoring resources, medium-risk scenarios identify hidden dangers in advance, and high-risk scenarios are dealt with quickly, effectively reducing the loss of power metering data security incidents. Attached Figure Description

[0016] Figure 1 A schematic diagram of the power metering data security risk assessment method provided in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0018] It should be noted that the acquisition of data and collection of information in this application are legal, compliant, or obtained with the consent of the subject of the data collection.

[0019] like Figure 1 As shown, the present invention provides a method for assessing the security risks of power metering data, comprising the following steps: Step 1: Collect multi-source power metering data of distribution nodes or transformer substations within the target area and construct a high-dimensional feature matrix; Specifically, the collection of multi-source data for power metering needs to cover three categories: core metering data, dynamic characteristic data of scenarios, and equipment health status data. Core metering data includes features such as the effective value of three-phase current at nodes, the effective value of three-phase voltage at nodes, total active power, total reactive power, power factor, and total harmonic distortion rate, reflecting core parameters of power operation. Dynamic characteristic data of scenarios includes features such as distributed photovoltaic access power, distributed wind power access power, new energy penetration rate, industrial / residential / commercial / public load ratio, time-period load fluctuation rate, and peak-valley load ratio, capturing dynamic changes in the external scenario. Equipment health status data includes features such as the cumulative operating time of metering equipment, the remaining days of the calibration cycle, the deviation value of the last calibration, real-time operating temperature, internal humidity of the equipment, cumulative number of faults, and sensor drift, reflecting the status of the metering equipment itself.

[0020] After data collection, Z-score standardization was first used to standardize the three types of multi-source electricity metering data. This process eliminated the dimensional differences between different features, making various features comparable and providing a unified scale for subsequent model calculations.

[0021] Outliers in the data are identified and removed using the 3σ criterion. Data exceeding ±3 standard deviations of the sample mean are considered outliers to avoid interference from extreme data on the accuracy of the evaluation results. Missing values ​​encountered during data collection are imputed using K-nearest neighbor interpolation, utilizing the nearest neighbor samples with the highest similarity to the missing data samples to ensure data integrity and continuity.

[0022] The construction of the high-dimensional feature matrix must follow a fixed classification order. The standardized feature results are arranged sequentially according to the core measurement data, scene dynamic feature data, and equipment health status data, forming a feature vector for each individual sample. The feature vectors of all valid samples are then stacked row-wise and integrated into a high-dimensional feature matrix. , where m is the number of valid samples collected, and n is the total number of features in the high-dimensional feature matrix. This matrix can centrally carry the feature information of multi-source data, providing a data foundation for subsequent model input.

[0023] Step 2: Quantify the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment respectively; based on the quantification results, construct a dynamic risk assessment model that integrates the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment; dynamically update the prior probability and likelihood function of the dynamic risk assessment model. This step is mainly used for the construction and parameter updating of dynamic risk assessment models. Its core is to build a dynamic risk assessment model that integrates the statistical distribution of scene features and the health degradation law of metering equipment, so as to realize the dynamic updating of the prior probability and likelihood function of risk assessment.

[0024] First, statistical distribution fitting is performed on the scene dynamic feature data. A Gaussian Mixture Model (GMM) is used to capture the complex distribution characteristics of scene features. The Expectation-Maximization (EM) algorithm is used to estimate the model parameters (mean, covariance, and mixture weights of each Gaussian component). Then, the number of model components is determined by the Bayesian Information Criterion (BIC). The BIC values ​​for different numbers of components are calculated, and the number of components with the smallest BIC value is selected as the optimal number of components for the model. Finally, the probability density function of the scene dynamic features under different risk levels is obtained. This function can quantify the relationship between different risk levels and scenario characteristics, providing scenario-level quantitative basis for risk assessment.

[0025] Subsequently, through joint statistical modeling of multi-dimensional health indicators and survival analysis of cumulative failure risk, the health degradation pattern of metering equipment was quantified. Equipment Health Index H The calculation formula is ,in, N The number of feature dimensions for the device health status data; For the first i Standardized statistics on the health status of a type of device are used to reflect the status of a single type of health indicator. For the first i The 95% confidence level statistical control threshold for health data is determined based on the quantiles of historical health data and serves as the benchmark for judging health status. The slope of the sigmoid function ranges from 0.5 to 2.0 and is determined through cross-validation (it iterates through the values ​​within this range and selects the one that best matches the actual equipment failure status). value); The cumulative attenuation coefficient is determined by fitting an exponential attenuation model based on historical data of equipment performance degradation after a failure. The model uses the post-failure operating time as the independent variable and the degree of equipment performance degradation (e.g., metering accuracy deviation rate) as the dependent variable. The coefficients of the fitted exponential attenuation model are then obtained. ; For the first j The relative percentage of runtime following each failure is a statistical measure. This represents the cumulative number of failures, reflecting the long-term impact of failures on equipment health. This health index integrates multi-dimensional health information with the cumulative effect of failures to comprehensively reflect the evolution of the health status of metering equipment.

[0026] Combining probability density function Equipment health index H The posterior probability is calculated using the Bayesian posterior update formula and then updated to the prior probability of risk assessment. The Bayesian posterior update formula is as follows: ,in, To combine equipment health index and scene dynamic feature data Post-risk level R The posterior probability; R Risk level; Risk level R The Beta distribution likelihood function of the device health index has the following core parameters (shape parameters). , (This needs to be based on risk level) R The corresponding historical equipment health index data was calculated using the maximum likelihood estimation method to quantify the correlation between the health index and the risk level. The initial prior probability can be determined by statistical analysis of the historical risk levels of distribution nodes or transformer substations in the target area. If no historical data is available, the probability is assigned based on the experience of industry experts. This formula enables dynamic adjustment of the prior probability as scene characteristics change and equipment health deteriorates, avoiding evaluation bias caused by static assumptions. For different risk levels Scene dynamic feature data The probability density function; Risk level The initial prior probability; The variable is an integral dummy variable, representing the risk level. Iterate through and retrieve values.

[0027] The dynamic risk assessment model is a probabilistic assessment model that integrates multi-source features, comprising three layers: an input layer, a feature fusion layer, and a probability output layer. The input layer receives the high-dimensional feature matrix constructed in step 1 and transforms it into a standardized data format that the model can process. The feature fusion layer integrates the high-dimensional feature matrix with the equipment health index H and the probability density function. To achieve comprehensive integration, the system fully explores the potential correlations between multi-source data, forming a complete set of fused features. The specific integration method involves vector concatenation and weight allocation: converting the single-sample feature vector (n-dimensional) corresponding to the high-dimensional feature matrix, the numerical value of the device health index H into a 1-dimensional vector, and the probability density function of the scene's dynamic features under different risk levels. The resulting k-dimensional vector (where k is the risk level) is arranged as follows: "High-dimensional feature vector → Health index vector → The probability vectors are sequentially concatenated to form an (n+1+k)-dimensional fused feature vector, while basic weights are assigned to different parts to ensure that the contribution of multi-source features aligns with the core logic of risk assessment; the core of the probability output layer is to construct the likelihood function. The construction process involves fitting a multidimensional normal distribution of the high-dimensional feature matrix under different risk levels based on the correlation data between historical high-dimensional feature matrices and corresponding risk levels, and using the likelihood function. This is the probability density function of the multidimensional normal distribution, and the formula is: , where n is the feature dimension of the high-dimensional feature matrix; Let be the mean vector of the high-dimensional features under risk level R. The covariance matrix of high-dimensional features under risk level R. for The inverse matrix.

[0028] By fusing likelihood functions , and The dynamic risk assessment model outputs the posterior probability distribution of risk levels, providing a probabilistic basis for subsequent risk prediction.

[0029] Step 3: Input the high-dimensional feature matrix into the dynamic risk assessment model, combine the improved LSTM time series prediction model and Markov chain state transition algorithm to predict the probability distribution of risk values, obtain the confidence interval of risk values, and deduce the risk evolution trend to obtain the risk transmission probability. This step is mainly used for risk prediction, evolutionary deduction, and risk value calculation. Through the synergistic effect of the improved LSTM time series prediction model and the Markov chain state transition algorithm, the probability distribution of risk value is predicted, its mathematical expectation and standard deviation statistical characteristics are extracted, and combined with the preset confidence level, the confidence interval of the risk value is calculated to perform risk evolution trend deduction.

[0030] First, the improved LSTM time-series forecasting model, which incorporates GARCH volatility modeling, outputs point prediction results for risk values. The core improvement of this model lies in integrating the volatility characteristics of electricity metering data captured by the GARCH model into the input layer of the LSTM model. The GARCH (1,1) model was selected to extract the volatility characteristics of the electricity metering data. The volatility values ​​corresponding to each time series node were calculated by the model and then these values ​​were organized into a volatility feature vector. The volatility feature is matched with the time series feature vector corresponding to the high-dimensional feature matrix and then concatenated (for example, if the high-dimensional feature time series vector is 9-dimensional, the 1-dimensional volatility feature vector is concatenated with the 9-dimensional time series vector to form a 10-dimensional input vector), and then input into the LSTM model. The GARCH model can improve the ability to capture the volatility clustering characteristics of power data. This fusion method can enhance the LSTM model's ability to capture the time series change patterns of power data, reduce the prediction error caused by volatility characteristics, and make the risk value point prediction results more accurate.

[0031] Based on historical transfer records of risk levels, the transfer frequency between each risk level is statistically analyzed. To avoid the extreme case of a transfer probability of 0, the transfer frequency is smoothed using Laplace smoothing with a smoothing coefficient of 1. The processing formula is as follows: ; Subsequently, using the Markov chain state transition algorithm, the processed transition frequencies are constructed into a state transition matrix of risk level number × risk level number (e.g., a 3×3 matrix corresponding to 3 risk levels). Each element in the matrix represents the probability of transitioning from one risk level to another, providing a core basis for predicting risk evolution trends.

[0032] Then, the risk evolution trend is deduced by combining the state transition matrix: If it is necessary to extrapolate the risk trend over the next k time windows, where k ranges from 3 to 7, specifically determined by the data collection cycle of electricity metering and the timeliness of risk response (for example, when the collection cycle is 15 minutes, k is set to 4 by default, corresponding to the risk trend extrapolation for the next hour), then the state transition matrix is ​​raised to the power of k to obtain a k-step state transition matrix; the risk level is divided into low... ,middle ,high Taking the three classes as an example, the initial state transition matrix is ​​M= If k=2, then performing a power-2 operation on M yields the two-step state transition matrix M. 2 The element M in the matrix 2 ( , This represents the probability of transitioning from low risk to high risk within two time windows.

[0033] Based on the k-step state transition matrix, the transition probability of each risk level is associated with the risk value prediction results of the corresponding risk level output by the improved LSTM model in step 3. The probability and risk value are matched one by one according to the time window to obtain the probability of the current risk level transitioning to each level in the next k windows. The joint probability distribution of risk values ​​is obtained simultaneously, clearly presenting the distribution of risk values ​​at different time nodes in the future, and realizing a forward-looking analysis from the current risk state to the future risk situation.

[0034] Among them, the probability of risk transmission As a core quantitative indicator of risk evolution trends, its calculation formula is: ,in, Number of timing windows Step state transition matrix, The current risk level is... The risk level is higher than the current level. For k steps from Transfer to The probability. For example, the current risk level is low risk ( = ), k=2, M in the 2-step state transition matrix 2 ( , =0.22, M 2 ( , If ) = 0.08, then the probability of risk transmission is... 0.22 + 0.08 = 0.3, meaning the total probability of the current risk spreading to medium or high risk levels within the next two windows is 30%. This indicator can quantify the likelihood of the current risk spreading to a higher risk level, providing a key reference for the formulation of prevention and control strategies.

[0035] Among them, risk value The formula is calculated by fusing the statistical characteristics of the probability distribution: ,in, The mathematical expectation of the risk value reflects the average level of the risk value; The coefficient of variation of the risk distribution reflects the degree of dispersion of the risk value; The weighting coefficients are used to adjust the influence of the expected value and the coefficient of variation on the final risk value. This fusion calculation achieves a comprehensive consideration of the risk level and risk volatility characteristics, making the risk value more fully reflect the actual risk situation.

[0036] Step 4: Based on the confidence interval of the risk value and the risk transmission probability, output the hierarchical prevention and control strategy and the iterative optimization instructions for model parameters.

[0037] This step involves the output of a tiered prevention and control strategy and the iterative optimization of model parameters. The tiered prevention and control strategy is formulated based on the dual criteria of the upper limit of the 95% confidence interval of the risk value and the probability of risk transmission, thereby achieving accurate risk grading and differentiated prevention and control.

[0038] The upper limit of the 95% confidence interval for the risk value needs to be calculated based on the joint probability distribution of the risk value obtained in step 3: if the risk value follows a normal distribution, then the upper limit of the 95% confidence interval is: the expected value of the risk value + 1.96 × the standard deviation of the risk value; if it is another distribution, then the 95% quantile is calculated through the quantile function of the corresponding distribution and used as the upper limit of the confidence interval.

[0039] Low-risk levels correspond to a 95% confidence interval upper limit of risk value ≤ 0.3 and a risk transmission probability < 10%. In this case, conventional monitoring strategies are adopted, and multi-source power metering data are collected according to the original cycle and the dynamic risk assessment model is verified. Under the premise of ensuring that the risk is within a controllable range, the consumption of monitoring resources is reasonably controlled to achieve efficient utilization of resources.

[0040] The medium-risk level corresponds to a 95% confidence interval upper limit of 0.3-0.7 and a risk transmission probability of 10%-30%. An enhanced monitoring strategy is adopted, shortening the data collection cycle to 50% of the original cycle to improve the timeliness of data collection. At the same time, a special investigation of equipment health status data is launched (focusing on checking core health indicators such as equipment operating temperature and cumulative number of failures) to identify and eliminate potential hidden dangers in advance and prevent further escalation of risks.

[0041] A high-risk level corresponds to a risk value with a 95% confidence interval upper limit > 0.7 and a risk transmission probability ≥ 30%. An emergency prevention and control strategy is adopted, which suspends the settlement use of the metering data at this node to avoid economic losses or security problems caused by erroneous data. At the same time, it triggers the offline calibration or replacement process of the equipment to quickly reduce the risk level and ensure the security and reliability of power metering data.

[0042] The model parameter iterative optimization uses the KS value and the PSI value of the population stability index from the prediction results of the dynamic risk assessment model as the core evaluation indicators: The KS value is calculated as follows: the maximum absolute difference between the cumulative distribution function of the probability of the risk level predicted by the model and the cumulative distribution function of the actual risk level. The target threshold is ≥0.4. It is used to measure the model's ability to distinguish between different risk levels. The higher the KS value, the higher the accuracy of the model's risk level identification. The PSI value is calculated as follows: After binning the new / old data according to risk value, calculate the difference in the distribution proportion of each bin, and then sum the weighted differences. The formula is simplified as follows: The target threshold is <0.1, which is used to measure the stability of the model on new data. The lower the PSI value, the stronger the model's adaptability to changes in data features.

[0043] A grid search algorithm is used to optimize the parameters of the covariance matrix weights of the dynamic risk assessment model, the smoothing coefficients of the Markov chain state transition algorithm, and the learning rate of the improved LSTM time series prediction model. The preset parameter ranges are: covariance matrix weights 0.1-1.0 (step size can be set to 0.1), Markov chain smoothing coefficients 0.5-2.0 (step size can be set to 0.5), and improved LSTM learning rate 0.001-0.01 (step size can be set to 0.001). By iterating through the parameter combinations within the above range, the optimal parameter combination that makes both the KS value and the PSI value simultaneously meet the target threshold is selected.

[0044] When the number of newly collected multi-source electricity metering data reaches the preset number, a parameter iteration is triggered: The preset number of groups ranges from 50 to 100, depending on the data collection cycle and model iteration efficiency (the shorter the collection cycle, the fewer the preset number of groups can be). The optimized parameters are fed back to the dynamic risk assessment model and the improved LSTM time series prediction model to achieve adaptive updates of the two types of models. This ensures that the models can continuously adapt to changes in the characteristics of power metering data and the evolution of equipment status, and maintain high assessment accuracy and stability in the long term.

[0045] In addition, this embodiment also discloses a power metering data security risk assessment device for performing the power metering data security risk assessment method, the device comprising: The matrix construction module is used to collect multi-source power metering data of distribution nodes or transformer areas within the target area and construct a high-dimensional feature matrix. The model building module is used to quantify the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment, respectively; based on the quantification results, a dynamic risk assessment model integrating the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment is constructed; and the prior probability and likelihood function of the dynamic risk assessment model are dynamically updated. The confidence interval and risk transmission probability calculation module is used to input the high-dimensional feature matrix into the dynamic risk assessment model, combine the improved LSTM time series prediction model and Markov chain state transition algorithm to predict the probability distribution of risk values, obtain the confidence interval of risk values, and perform risk evolution trend deduction to obtain the risk transmission probability. The prevention and control strategy output and parameter optimization module is used to output hierarchical prevention and control strategies and model parameter iterative optimization instructions based on the confidence interval of the risk value and the risk transmission probability.

[0046] Finally, it should be noted that the above embodiments are merely illustrative and explanatory of the present invention, and are not intended to limit the present invention to the scope of the described embodiments. Furthermore, those skilled in the art will understand that the present invention is not limited to the above embodiments, and many more variations and modifications can be made based on the teachings of the present invention, all of which fall within the scope of protection claimed by the present invention.

Claims

1. A method for assessing the security risks of electricity metering data, characterized in that, Includes the following steps: Step 1: Collect multi-source power metering data of distribution nodes or transformer substations within the target area and construct a high-dimensional feature matrix; Step 2: Quantify the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment respectively; based on the quantification results, construct a dynamic risk assessment model that integrates the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment; dynamically update the prior probability and likelihood function of the dynamic risk assessment model. Step 3: Input the high-dimensional feature matrix into the dynamic risk assessment model, combine the improved LSTM time series prediction model and Markov chain state transition algorithm to predict the probability distribution of risk values, obtain the confidence interval of risk values, and deduce the risk evolution trend to obtain the risk transmission probability. Step 4: Based on the confidence interval of the risk value and the risk transmission probability, output the hierarchical prevention and control strategy and the iterative optimization instructions for model parameters.

2. The method for assessing the security risks of power metering data according to claim 1, characterized in that, In step 1, the multi-source data for power metering includes core metering data, dynamic characteristic data of the scenario, and equipment health status data. The core metering data includes the effective value of the three-phase current at the node, the effective value of the three-phase voltage at the node, the total active power, the total reactive power, the power factor, and the total harmonic distortion rate. The dynamic characteristic data of the scenario includes the distributed photovoltaic access power, the distributed wind power access power, the penetration rate of new energy, the proportion of industrial / residential / commercial / public loads, the load fluctuation rate during the time period, and the peak-valley load ratio. The equipment health status data includes the cumulative running time of the metering equipment, the remaining days of the calibration cycle, the deviation value of the last calibration, the real-time operating temperature, the internal humidity of the equipment, the cumulative number of faults, and the sensor drift.

3. The method for assessing the security risks of power metering data according to claim 2, characterized in that, Step 1, the process of constructing the high-dimensional feature matrix, specifically includes the following: Step 1.1: Standardize the multi-source power metering data using Z-score standardization to obtain the first multi-source power metering data; Step 1.2: For the first power metering multi-source data, outliers are identified and removed using the 3σ criterion, and missing values ​​are filled in using the K-nearest neighbor interpolation method to obtain the second power metering multi-source data; Step 1.3: Arrange the second power metering multi-source data in the order of core metering data, scenario dynamic feature data, and equipment health status data. Each data sample forms a feature vector for a single sample. Stack all the feature vectors of the samples row by row to integrate them into a high-dimensional feature matrix. ,in, m The number of valid samples collected. n is the total number of features in the high-dimensional feature matrix.

4. The method for assessing the security risks of power metering data according to claim 3, characterized in that, Step 2, which involves quantifying the statistical distribution patterns of distribution node or transformer area scene characteristics, specifically includes: fitting the statistical distribution of scene dynamic characteristic data using a Gaussian mixture model, determining the number of model components using the Bayesian information criterion, and obtaining different risk levels. R Scene dynamic feature data probability density function ; The steps for quantifying the health degradation patterns of metering equipment specifically include: calculating the equipment health index. H The formula is as follows: ； in, The number of feature dimensions for the device health status data; For the first i Standardized statistics for health status data of various types of equipment; For the first i The statistical control threshold for the 95% confidence level of health-related data is determined based on the quantiles of historical health status data. The slope of the sigmoid function is obtained by fitting the correlation data between historical health status indicators and actual failure occurrences using the least squares method. The fitting objective is to minimize the mean square error between the predicted health status and the actual health status. The cumulative attenuation coefficient is fitted based on historical data of equipment performance degradation after a fault; For the first j The relative percentage of runtime following each failure is a statistical measure. This represents the cumulative number of faults.

5. The method for assessing the security risks of power metering data according to claim 4, characterized in that, In step 2, the dynamic risk assessment model is a probabilistic assessment model that integrates multi-source features, including: The input layer is used to receive high-dimensional feature matrices; Feature fusion layer, used to combine high-dimensional feature matrix with device health index H Different risk levels R Scene dynamic feature data S probability density function By performing correlation and integration, a comprehensive feature is obtained that combines multi-source scene features and device health status; The probability output layer outputs the posterior probability distribution of the risk level based on the comprehensive features of multi-source scene features and device health status.

6. The method for assessing the security risks of power metering data according to claim 5, characterized in that, Step 2 involves dynamically updating the prior probabilities of the dynamic risk assessment model, specifically including the following: Combined with different risk levels R Scene dynamic feature data S probability density function Equipment health index H The posterior probability is calculated using the Bayesian posterior update formula and then updated to the prior probability of risk assessment; wherein the Bayesian posterior update formula is: ； in, To combine equipment health index and scene dynamic feature data Post-risk level R The posterior probability; Risk level R The likelihood function of the Beta distribution of the device health index. For different risk levels Scene dynamic feature data The probability density function; Risk level The initial prior probability; The variable is an integral dummy variable, representing the risk level. Iterate through and retrieve values; The likelihood function of the dynamic risk assessment model is updated dynamically, specifically including the following: Based on the correlation data between historical high-dimensional feature matrices and corresponding risk levels, a multidimensional normal distribution of the high-dimensional feature matrices under different risk levels R is fitted to obtain the likelihood function. Let be the probability density function of this multidimensional normal distribution, as shown in the following formula: ； Where n is the feature dimension of the high-dimensional feature matrix. Risk level R The mean vector of the high-dimensional features. Risk level R The covariance matrix of the high-dimensional features. for The inverse matrix; T denotes the matrix inversion; The probability output layer is fused , and Output the posterior probability distribution of the risk level.

7. The method for assessing the security risks of power metering data according to claim 6, characterized in that, Step 3 specifically includes the following: An improved LSTM time series prediction model integrating GARCH volatility modeling is adopted. The volatility characteristics of electricity metering data captured by the GARCH model are incorporated into the input layer of the LSTM model. Combined with the output of the dynamic risk assessment model, the probability distribution prediction of the risk value is completed, and its mathematical expectation and standard deviation statistical characteristics are extracted. Combined with the preset confidence level, the confidence interval of the risk value is calculated. Based on the historical transfer records of risk levels, the transfer frequency between each risk level is statistically analyzed. After Laplace smoothing, a state transition matrix is ​​constructed using the Markov chain state transition algorithm. Combined with the output of the dynamic risk assessment model, the risk evolution trend is deduced, and the risk transmission probability is obtained through quantitative calculation. Wherein, the risk transmission probability The calculation formula is as follows: ； in, Number of timing windows Step state transition matrix, The current risk level is... The risk level is higher than the current level. for k Step inside from Transfer to The probability of; Wherein, the risk value The calculation formula is as follows, which is derived by fusing the statistical characteristics of the probability distribution: ; in, The mathematical expectation of the risk value, Let be the coefficient of variation of the risk distribution. These are the weighting coefficients.

8. The method for assessing the security risks of power metering data according to claim 7, characterized in that, In step 4, the output logic of the tiered prevention and control strategy is as follows: Based on the upper limit of the 95% confidence interval of the risk value and the risk transmission probability, the risk is divided into three levels: low risk, medium risk, and high risk. For low-risk levels, the upper limit of the risk value confidence interval is ≤0.3 and the risk transmission probability is <10%. Conventional monitoring strategies are adopted, and multi-source power metering data are collected according to the original preset collection cycle and the dynamic risk assessment model is verified. For medium-risk levels, the upper limit of the risk value confidence interval is 0.3-0.7 and the risk transmission probability is ≥10% and <30%. An enhanced monitoring strategy is adopted, shortening the data collection cycle to 50% of the original preset collection cycle, and simultaneously launching a special investigation of equipment health status data. For high-risk levels, the upper limit of the risk value confidence interval is >0.7 and the risk transmission probability is ≥30%. Emergency prevention and control strategies are adopted, such as suspending the settlement of metering data at this node and triggering offline calibration or replacement procedures for the equipment. If the upper limit of the risk value confidence interval and the risk transmission probability do not meet the dual conditions required for either of the above levels, the prevention and control strategy shall be implemented according to the higher level of the risk levels corresponding to the two indicators.

9. The method for assessing the security risks of power metering data according to claim 8, characterized in that, In step 4, the process of outputting the model parameter iterative optimization instruction is as follows: If the number of newly collected multi-source power metering data reaches the preset number, a parameter iteration is triggered. A grid search algorithm is used to optimize the parameters of the covariance matrix weights of the dynamic risk assessment model, the smoothing coefficients of the Markov chain state transition algorithm, and the learning rate of the improved LSTM time series prediction model. The core indicators are the KS value and the PSI value of the dynamic risk assessment model prediction results. The KS value is the discrimination index of the model prediction results after separating the high-risk level from the three risk levels and merging the low-risk and medium-risk levels into a non-high-risk level. The target threshold of the KS value is ≥0.4 and the target threshold of the PSI value is <0.

1. If, after traversing all parameter combinations, there is no combination that simultaneously satisfies KS≥0.4 and PSI<0.1, then the combination with KS value closest to 0.4 and PSI value closest to 0.1 is selected as the suboptimal solution, and the parameter range corresponding to this combination is expanded outward by a preset magnitude while keeping the step size unchanged, and the grid search is re-executed once. The optimized parameters are fed back to the dynamic risk assessment model and the improved LSTM time series prediction model to achieve adaptive model updates.

10. A power metering data security risk assessment device, used to execute the power metering data security risk assessment method as described in any one of claims 1-9, characterized in that, The device includes: The matrix construction module is used to collect multi-source power metering data of distribution nodes or transformer areas within the target area and construct a high-dimensional feature matrix. The model building module is used to quantify the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment, respectively; based on the quantification results, a dynamic risk assessment model integrating the statistical distribution patterns of distribution node or transformer area scene characteristics and the health degradation patterns of metering equipment is constructed; and the prior probability and likelihood function of the dynamic risk assessment model are dynamically updated. The confidence interval and risk transmission probability calculation module is used to input the high-dimensional feature matrix into the dynamic risk assessment model, combine the improved LSTM time series prediction model and Markov chain state transition algorithm to predict the probability distribution of risk values, obtain the confidence interval of risk values, and perform risk evolution trend deduction to obtain the risk transmission probability. The prevention and control strategy output and parameter optimization module is used to output hierarchical prevention and control strategies and model parameter iterative optimization instructions based on the confidence interval of the risk value and the risk transmission probability.

Images