Power grid abnormal event handling method and system based on knowledge graph

Abstract

The invention relates to the technical field of power grid exception handling, and discloses a power grid exception event handling method and system based on a knowledge graph. The method comprises the following steps: collecting time sequence data flow and space coordinate information of a power grid abnormal event in real time through multi-source sensing equipment, and fusing equipment operation parameters to construct a dynamic event data pool; performing graph structure conversion on the dynamic event data pool based on a knowledge graph topological connection relationship, calculating event node propagation path intensity and generating an event propagation network model; key abnormal indexes are separated out from the model by adopting a multi-modal feature extraction technology, risk probability calculation is completed in combination with an adaptive learning algorithm, and an abnormal risk distribution diagram is output; and classifying event levels according to the graph, and automatically generating a processing instruction sequence. According to the method, omnibearing data perception and accurate analysis of the abnormal events of the power grid are realized, an event propagation rule is clearly presented, risk assessment is enabled to be closer to an actual operation state, and accurate guidance is provided for abnormal disposal.

Description

Technical Field

[0001] This invention relates to the field of power grid anomaly handling technology, specifically to a method and system for handling power grid anomaly events based on knowledge graphs. Background Technology

[0002] With the rapid development of power systems towards intelligence and large-scale operation, the power grid structure exhibits characteristics of "numerous nodes, complex links, and strong dynamism." The integration of various distributed power sources and smart loads makes the power grid operation increasingly complex, significantly increasing the frequency of abnormal events and the associated risks. Power grid abnormal events involve various types, including equipment failures, line overloads, voltage dips, and frequency fluctuations. These events are characterized by rapid propagation, wide impact, and complex correlations. If not handled promptly or with inappropriate measures, they can easily trigger cascading failures, leading to large-scale power outages and posing a serious threat to the continuity of industrial production, the convenience of residents' lives, and even public safety.

[0003] At the data processing level, existing solutions mostly rely on single-type sensing devices for data acquisition, only obtaining electrical parameters for local areas. This makes it difficult to simultaneously capture the temporal evolution characteristics and spatial distribution patterns of abnormal events. Furthermore, the lack of unified standards in data formats across different monitoring systems results in fragmented information such as equipment operating parameters, environmental monitoring data, and fault records, hindering the construction of a complete event description dimension. At the analysis and modeling level, traditional methods often conduct isolated analyses detached from the power grid topology, relying heavily on empirical formulas or static statistical models to calculate risks. This fails to accurately depict the propagation path and impact intensity of abnormal events between power grid nodes, making it difficult to effectively predict event development trends.

[0004] At the decision-making and handling level, the extraction of key anomaly indicators is often limited to single-modal data, failing to comprehensively reflect the complex characteristics of events. Furthermore, risk assessment algorithms lack adaptability, struggling to adjust calculation logic based on dynamic changes in power grid operation, leading to discrepancies between assessment results and actual risks. The generation of handling instructions heavily relies on the on-site experience of maintenance personnel, resulting in delayed responses and potential human error leading to ineffective handling measures and further amplifying the event's impact. This invention aims to address the technical problems in existing technologies, such as incomplete data collection dimensions, inaccurate characterization of event propagation patterns, poor adaptability of risk assessment, and low efficiency in generating handling instructions. By integrating knowledge graphs and multi-source data processing technologies, it constructs a power grid anomaly event handling method that combines timeliness and accuracy. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for handling abnormal power grid events based on knowledge graphs, so as to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, this invention provides a method for handling abnormal power grid events based on knowledge graphs, the method comprising:

[0007] By collecting real-time time-series data streams and spatial coordinate information of abnormal power grid events through multi-source sensing devices, and integrating equipment operating parameters, a dynamic event data pool is constructed.

[0008] Based on the topological connections of knowledge graphs, the dynamic event data pool is transformed into a graph structure, the propagation path strength between event nodes is calculated, and an event propagation network model is generated.

[0009] Multimodal feature extraction technology is used to extract key anomaly indicators from the event propagation network model, and an adaptive learning algorithm is used to calculate the risk probability and output an anomaly risk distribution map.

[0010] The event levels are classified based on the abnormal risk distribution map, and a sequence of handling instructions is automatically generated.

[0011] Preferably, the specific process of collecting time-series data streams and spatial coordinate information of abnormal power grid events in real time through multi-source sensing devices and constructing a dynamic event data pool by fusing equipment operating parameters includes: obtaining the timestamp sequence and geographic coordinate set of abnormal events from the power grid monitoring platform; synchronously collecting voltage waveform data, current phase data, and load fluctuation data of related devices; aligning and buffering the collected results according to time windows to generate raw event stream data; cleaning the raw event stream data, including removing outliers, compensating for missing points, and smoothing filtering, and unifying the data sampling frequency and dimensions to obtain standardized event data groups; associating and mapping the standardized event data groups with device identifiers; and integrating multi-dimensional parameters through a data fusion engine to form a dynamic event data pool.

[0012] Preferably, the specific process of transforming the dynamic event data pool into a graph structure based on the knowledge graph topological connection relationship, calculating the propagation path strength between event nodes, and generating an event propagation network model includes: extracting the device number and location coordinates of each event point from the dynamic event data pool; constructing an edge connection set between event points according to the node connection relationship in the knowledge graph; calculating the electrical distance and topological hop count between each pair of event points; quantifying the path strength by combining the device type weight; and generating a propagation path strength matrix. Based on the propagation path strength matrix, constructing a graph structure with event points as nodes and path strength as edge weights, and adding a time dimension label to form an event propagation network model.

[0013] Preferably, the specific process of extracting key anomaly indicators from the event propagation network model using multimodal feature extraction technology, calculating risk probability using an adaptive learning algorithm, and outputting an anomaly risk distribution map includes: extracting node degree centrality features, edge weight distribution features, and temporal evolution features from the event propagation network model; performing feature normalization and dimensionality reduction to obtain a fused feature vector; using a deep learning model to perform anomaly pattern recognition on the fused feature vector and outputting an anomaly confidence score for each event point; performing risk probability regression calculation based on the anomaly confidence score and a historical event database to generate a risk probability value for each event point; and mapping the risk probability value to the power grid geographic space to generate an anomaly risk distribution map.

[0014] Preferably, the detailed steps of using a deep learning model to perform abnormal pattern recognition on the fused feature vector include: constructing a deep neural network structure, where the input layer receives the fused feature vector, the hidden layer performs feature transformation and nonlinear activation, and the output layer generates anomaly confidence; optimizing network parameters using a backpropagation algorithm, and using historical abnormal event data as training samples for model training; inputting the real-time fused feature vector into the trained model, and calculating the anomaly confidence score.

[0015] Preferably, the detailed steps of performing risk probability regression calculation based on the anomaly confidence score and in conjunction with the historical event database include: retrieving case data with similar anomaly patterns from the historical event database, extracting the event spread speed and impact range indicators from the cases; using a regression algorithm to fit the relationship between the anomaly confidence score and the spread speed and impact range to obtain the risk probability calculation function; inputting the real-time anomaly confidence score into the risk probability calculation function, and outputting the risk probability value.

[0016] Preferably, the specific process of classifying events into levels based on the abnormal risk distribution map and automatically generating a sequence of handling instructions includes: setting a risk probability threshold range and dividing the risk probability values ​​in the abnormal risk distribution map into three levels: low, medium, and high; assigning color codes and warning level identifiers to each level; and matching corresponding operation instructions from the handling strategy library based on the event level and location information, including parameter adjustment, equipment isolation, or load transfer commands, to generate a sequence of handling instructions.

[0017] Preferably, the process of constructing the disposal strategy library includes: collecting historical successful disposal cases, extracting event type, equipment status and operation data from the cases; grouping the cases using a clustering algorithm to form typical disposal patterns; and writing standardized instruction templates for each pattern and storing them as the disposal strategy library.

[0018] Preferably, the method further includes the step of updating the knowledge graph in real time: monitoring power grid topology change events, automatically adjusting the nodes and edges in the knowledge graph when the device connection relationship changes, and recalculating the propagation path strength.

[0019] Preferably, the present invention also includes a knowledge graph-based power grid anomaly event handling system, the system including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, it implements the steps of the knowledge graph-based power grid anomaly event handling method described above.

[0020] Compared with the prior art, the beneficial effects of the present invention are:

[0021] By employing multi-source sensing devices, comprehensive data collection of power grid anomaly events is achieved. This includes not only the time-series data stream of the events but also spatial coordinate information, and integrates equipment operating parameters to construct a dynamic event data pool. This multi-dimensional data collection and fusion model breaks through the limitations of traditional single-data collection, enabling the collected data to fully reflect the background, development process, and status of related equipment in anomaly events, providing rich and comprehensive foundational data for subsequent event analysis. The construction of the dynamic data pool allows for real-time updates of data content, ensuring that the data remains synchronized with the real-time status of power grid operation, avoiding analytical biases caused by data lag, and ensuring that subsequent event analysis is always based on the latest operational data.

[0022] Based on the topological connections of knowledge graphs, a graph structure transformation is performed on the dynamic event data pool, converting abstract data into an intuitive graph model that clearly presents the nodes involved in anomalies and the relationships between them. By calculating the propagation path strength between event nodes to generate an event propagation network model, the source, main propagation path, and potential impact range of anomalies can be accurately located, overcoming the bottleneck of traditional analysis methods that struggle to quantify event propagation characteristics. This visualized network model enables operations and maintenance personnel to quickly grasp the propagation patterns of anomalies, moving beyond vague experience-based judgments and gaining a clear understanding of event development trends, providing a clear direction for formulating subsequent response strategies.

[0023] The application of multimodal feature extraction technology can comprehensively mine different types of key anomaly indicators from event propagation network models, covering multiple dimensions such as electrical parameters, spatial distribution, and temporal changes, avoiding the one-sidedness of single-modal indicator extraction. Combined with adaptive learning algorithms for risk probability calculation, the algorithm can autonomously adjust its calculation logic and parameters according to the dynamic changes in the power grid's operating status, adapting to the needs of different types of anomaly events and different power grid operating scenarios, making the risk probability calculation results more consistent with reality. The output anomaly risk distribution map presents the risk level of each area of ​​the power grid in an intuitive form, clearly distinguishing between high-risk and low-risk areas, allowing maintenance personnel to quickly focus on core problem areas and prioritize resource allocation for handling.

[0024] Based on anomaly risk distribution maps, event levels are classified and response command sequences are automatically generated, achieving standardization and automation in anomaly event handling. Event levels are classified using objective risk distribution data, avoiding the subjectivity and arbitrariness of manual classification and ensuring fairness and accuracy. The automatically generated response command sequences eliminate the cumbersome process of manually developing solutions, significantly shortening the time from event discovery to command generation, enabling rapid implementation of response measures. The command sequences are generated based on precise analysis results, are highly targeted, and can directly guide maintenance personnel in their response work, reducing human error, improving the efficiency and quality of response work, effectively curbing the further development of anomalies, minimizing losses caused by events, and ensuring the safe and stable operation of the power grid. Attached Figure Description

[0025] Figure 1 This is a schematic diagram illustrating the working principle of the knowledge graph-based power grid abnormal event handling method described in this invention.

[0026] Figure 2 A flowchart for generating an event propagation network model;

[0027] Figure 3 A flowchart for outputting the abnormal risk distribution map;

[0028] Figure 4 This is a time-series graph showing the probability changes of anomalies in multiple regions of the power grid.

[0029] Figure 5 A comparison chart showing the computation time of incremental and full computation for different network sizes. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] Please see Figure 1This invention provides a knowledge graph-based method for handling abnormal events in power grids. The method includes: real-time acquisition of time-series data streams and spatial coordinate information of abnormal events using multi-source sensing devices deployed at key nodes of the power grid, such as voltage sensors, current transformers, and location acquisition devices. These data include timestamp sequences, geographic coordinate sets, and equipment operating parameters such as voltage waveforms, current phases, and load fluctuation data. The acquired data is aligned and buffered to form raw event stream data. Then, a data cleaning step is performed to remove outliers, compensate for missing points, and perform smoothing filtering. After unifying the sampling frequency and dimensions, a standardized event data set is generated. The standardized event data set is associated and mapped with equipment identifiers, and a data fusion engine is used to integrate multi-dimensional parameters to construct a dynamic event data pool. Based on predefined power grid topology connections in a knowledge graph, a graph structure transformation is performed on the dynamic event data pool. Equipment numbers and location coordinates of event points are extracted, and an edge connection set is constructed according to node connections. Electrical distances and topology hop counts between event points are calculated, and path strength is quantified by combining equipment type weights to generate a propagation path strength matrix. This matrix is ​​then used to construct a graph structure with event points as nodes and path strength as edge weights. Adding a time dimension label forms an event propagation network model. Multimodal feature extraction technology is used to extract key anomaly indicators from the event propagation network model, including node degree centrality features, edge weight distribution features, and temporal evolution features. These features are normalized and dimensionality reduced to obtain a fused feature vector. A deep learning model is used to perform anomaly pattern recognition on the fused feature vector, outputting anomaly confidence scores. These scores are then combined with a historical event database and a regression algorithm is used to calculate risk probability values. Finally, the risk probability values ​​are mapped to the power grid geospatial area to generate an anomaly risk distribution map. Based on the abnormal risk distribution map, risk probability threshold ranges are set to classify event levels, such as low, medium and high. Color codes and warning level labels are assigned to each level. Operation instructions are matched from the handling strategy library according to the event level and location information to generate handling instruction sequences such as parameter adjustment, equipment isolation or load transfer, so as to realize automated response.

[0032] Example 1: See Figure 2In practical implementation, multi-source sensing devices include voltage sensors, current transformers, temperature sensors, and GPS or BeiDou positioning modules deployed at key nodes of the power grid. These devices establish a continuous data connection with the power grid monitoring platform through a dedicated power grid or wireless communication network. The timestamp sequence of abnormal events obtained from the power grid monitoring platform is accurate to the millisecond level, and the geographic coordinate set is identified using a latitude and longitude coordinate system. The synchronously collected associated device operating parameters cover the specific amplitude and frequency of voltage waveform data, the angle difference of current phase data, and the real-time power change rate of load fluctuation data. The collected multi-source data stream first enters the data preprocessing module, where it is aligned according to a preset fixed time window or adaptive time window. The alignment algorithm is synchronized based on the earliest arriving timestamp or the master device clock. The buffer uses a circular queue structure to store the raw event stream data to prevent data overflow and ensure the temporal integrity of the data.

[0033] Data cleaning of raw event stream data is a multi-step iterative process. Outlier removal employs outlier detection methods based on statistical distributions, such as calculating the moving average and standard deviation of each data channel, marking data points deviating from the average by more than three times the standard deviation as outliers and removing them. Missing points are compensated using linear interpolation methods or spatial correlation interpolation algorithms based on adjacent sensor data. For multiple consecutively missing data points, time series prediction models such as autoregressive integral moving average models are used for estimation and imputation. Smoothing and filtering apply digital filters such as low-pass Butterworth filters or Kalman filters to suppress high-frequency noise and measurement interference. The filter cutoff frequency is set according to the power grid frequency and the characteristic frequency of the abnormal event. Unifying the data sampling frequency is achieved through resampling technology, upsampling or downsampling channel data with different sampling rates to a unified standard frequency. Unifying the dimensions involves physical unit conversion and per-unit processing, converting parameters such as voltage and current into per-unit values ​​or SI standard values ​​with a reference value, ultimately obtaining a standardized event data set.

[0034] The standardized event data sets are associated and mapped with equipment identifiers, which are sourced from the equipment ledger database in the power grid asset management system. Each equipment identifier uniquely corresponds to a physical equipment instance and includes an equipment type code, topology node number, and geographic location code. The association and mapping process is achieved through database connection operations or key-value pair matching, binding the measured values ​​in the standardized event data sets with the equipment identifiers. The data fusion engine employs a multi-source information fusion algorithm based on Kalman filtering or a decision-level fusion method based on DS evidence theory, integrating multi-dimensional parameters from different sensors, including electrical parameters, mechanical condition parameters, and environmental parameters. The data fusion engine outputs a comprehensive dynamic event data pool, organized as a time-series database or an in-memory database, supporting high-speed read / write and complex query operations.

[0035] The device ID and location coordinates of each event point are extracted from the dynamic event data pool. The device ID is precisely matched with predefined device nodes in the knowledge graph, which is stored in a graph database and contains power grid equipment entities, equipment attributes, and connection relationships between devices. Location coordinates are used to calculate the spatial distance and topological relationships between event points. An edge connection set is constructed based on the node connection relationships in the knowledge graph, explicitly representing the electrical connection paths between devices, such as a transmission line connecting two substation nodes, or a circuit breaker connecting a busbar node. The electrical distance between each pair of event points is calculated by calculating the equivalent impedance or admittance value between the two nodes. The impedance value is derived from the power grid power flow calculation database or equipment nameplate parameters. The topology hop count is calculated using a graph traversal algorithm such as breadth-first search or Dijkstra's shortest path algorithm to obtain the number of nodes traversed by the shortest path between the two event points. Path strength quantification is performed by combining equipment type weights. The equipment type weights are pre-set according to the criticality of the equipment in the power grid. For example, the weights of generator nodes and main transmission line nodes are higher than those of distribution transformer nodes. The path strength quantification formula uses electrical distance, topology hop count and equipment type weights as input variables for weighted calculation to generate a symmetric propagation path strength matrix.

[0036] Based on the propagation path strength matrix, a graph structure is constructed with event points as nodes and path strength as edge weights. The graph structure is stored and represented using an adjacency matrix or adjacency list data structure. Each node attribute includes the device number, location coordinates, and initial timestamp of the event point. Each edge attribute includes the numbers of the two connected event points and the calculated propagation path strength value. Adding time dimension labels involves attaching time-related attributes to each node and edge in the graph structure. These time dimension labels include the absolute time of event occurrence, the event duration, and the time offset relative to a reference time. The resulting event propagation network model is a weighted directed or undirected graph that can fully characterize the propagation potential and impact range of abnormal events in the spatiotemporal dimensions of the power grid. In some embodiments, the construction process of the event propagation network model is periodic or event-triggered to ensure that the model reflects the latest state of the power grid.

[0037] Example 2: See Figure 3In practical implementation, the event propagation network model serves as the input source, a graph structure containing nodes, edge weights, and time-dimensional labels. Node degree centrality features are extracted from the event propagation network model. These features are obtained by calculating the number of edges connected to each node; for directed graphs, in-degree and out-degree are calculated separately. Degree centrality reflects the direct influence of event nodes in the network. Edge weight distribution features are obtained by statistically analyzing the weights of all edges connected to a node. Statistical indicators include the arithmetic mean, standard deviation, maximum, and minimum weights, as well as skewness and kurtosis describing the distribution pattern. Edge weight distribution features characterize the tightness and stability of the connections between event nodes. Temporal evolution features are extracted from the time-dimensional labels attached to nodes and edges. These features include the absolute timestamp sequence of event occurrences, the time interval between adjacent events, the total duration of the event, and the frequency trend of the event. These features are used to capture the dynamic evolution of anomalous events over time.

[0038] The extracted node degree centrality features, edge weight distribution features, and temporal evolution features are subjected to feature normalization. Normalization employs a min-max scaling method to linearly transform feature values ​​of different dimensions and ranges to the [0,1] interval, or a Z-score standardization method to convert feature values ​​into a normal distribution with a mean of 0 and a standard deviation of 1. Dimensionality reduction is achieved using principal component analysis (PCA). PCA maps the original high-dimensional features to a low-dimensional orthogonal feature space through linear transformation, preserving the main variance components of the data. Alternatively, an autoencoder neural network is used to learn a compact representation of the features through the encoder and decoder structures. Finally, a dimensionality-reduced fused feature vector is obtained, which comprehensively represents the key information of the event propagation network model in terms of structure, weights, and time.

[0039] Anomaly pattern recognition is performed on fused feature vectors using a deep learning model. The deep learning model employs a deep neural network structure. The number of neurons in the input layer is strictly consistent with the dimension of the fused feature vector, and it is responsible for receiving the fused feature vector. The hidden layer consists of multiple fully connected layers, each containing a certain number of neurons. Layers are fully connected. The hidden layers use ReLU or Sigmoid activation functions to introduce non-linear transformation capabilities, enabling the model to learn complex anomaly patterns. The output layer is typically designed as a single neuron node. The Sigmoid activation function is used to compress the output value to between 0 and 1; this output value is the anomaly confidence score, directly representing the probability that the input event pattern is an anomaly. Backpropagation is used to optimize the parameters of the deep neural network model. Based on the error between the model's predicted output and the true label, backpropagation calculates the gradient of the loss function with respect to the weights of each layer in the network using the chain rule. A stochastic gradient descent optimizer or an Adam optimizer is used to update the network weights based on the calculated gradients to minimize the loss function. The historical anomalous event data samples used for model training need to be carefully labeled to clearly define the normal or anomalous category label for each sample. The training process usually divides the dataset into training set, validation set and test set to evaluate the generalization performance of the model.

[0040] The real-time generated fused feature vector is input into a pre-trained deep neural network model for forward propagation calculation. The forward propagation process starts from the input layer, calculating the weighted sum of each neuron layer by layer and applying activation functions until the output layer produces the final anomaly confidence score. Based on the calculated anomaly confidence score, a risk probability regression calculation is performed using a historical event database. The historical event database is a structured database storing a large amount of historical anomaly event case data. Each case data includes the anomaly confidence score at the time of the event, the actual rate of spread of the event, and the final scope of the event's impact. A regression algorithm is used to fit the mathematical relationship between the anomaly confidence score and the spread rate and scope of impact. The regression algorithm can be a multiple linear regression algorithm, establishing a linear regression equation with the anomaly confidence score as the independent variable and the spread rate and scope of impact as the dependent variables. The coefficient parameters in the regression equation are estimated using the least squares method, thus obtaining a risk probability calculation function. The real-time calculated anomaly confidence score is substituted into the risk probability calculation function, which outputs a quantified risk probability value that comprehensively reflects the potential harm and spread risk of the current anomaly event.

[0041] The calculated risk probability value for each event point is mapped onto the power grid geospatial area, which is constructed based on a Geographic Information System (GIS) platform and contains precise geographic coordinate information of power grid equipment. The mapping process involves associating and matching the equipment number or location coordinates of the event point with the equipment layer in the GIS. The risk probability values ​​are presented visually in the GIS, for example, using a color gradient representation to assign different colors to different risk probability ranges (e.g., green for low risk, yellow for medium risk, and red for high risk), or using contour lines to draw contour maps of risk probabilities, clearly showing the distribution of risk in the power grid geospatial area, ultimately generating an anomaly risk distribution map for decision support. In some embodiments, the parameters for feature normalization and dimensionality reduction can be dynamically adjusted based on real-time data distribution. Optionally, the historical event database can be updated online to include the latest handling cases. It can be understood that the anomaly risk distribution map provides an intuitive and quantitative spatial decision-making basis for subsequent event level classification and handling instruction generation.

[0042] Example 3: In practical implementation, constructing a deep neural network structure is fundamental. The number of neurons in the input layer of the deep neural network structure must be exactly the same as the dimension of the fused feature vector. Each neuron receives a specific feature component value from the fused feature vector. The hidden layers adopt a multi-layer fully connected architecture. The number of hidden layers is set according to the complexity of the anomaly pattern; for example, it can be configured as three or four fully connected layers. The number of neurons in each layer can decrease layer by layer to progressively extract abstract feature representations. Information is passed between layers using a fully connected approach. After each hidden layer, a ReLU activation function or a Sigmoid activation function is applied to introduce nonlinear transformation capability. The output layer is designed as a single neuron node. This neuron node uses the Sigmoid activation function to map the linearly weighted sum to a value between 0 and 1, which is the output anomaly confidence score.

[0043] The backpropagation algorithm is used to optimize the network parameters in the deep neural network structure, including connection weights and bias terms. The backpropagation algorithm first performs forward propagation calculations, inputting the fused feature vectors of the training samples into the deep neural network structure, calculating layer by layer until the predicted anomaly confidence score is obtained. The difference between the predicted value and the true label is calculated, and the prediction error is quantified using the cross-entropy loss function or the mean squared error loss function. Then, error backpropagation is performed, calculating the gradient of the loss function with respect to each network parameter layer by layer, starting from the output layer, according to the chain rule. Optimization algorithms such as stochastic gradient descent or the Adam optimizer are used to update the weights and bias parameters in the deep neural network structure based on the calculated gradient values. The model training uses historical anomaly event data as training samples. This historical anomaly event data needs to be accurately labeled beforehand. During training, the dataset is typically divided into a training set for parameter learning, a validation set for hyperparameter tuning, and a test set for evaluating the final model performance.

[0044] The real-time generated fused feature vector is input into the trained deep neural network model to perform a forward propagation process. The forward propagation process starts from the input layer, using the fused feature vector as the input signal, and propagates layer by layer through the deep neural network structure. Each neuron in a layer receives the output value of the neuron in the previous layer, performs a weighted summation and adds a bias term, then inputs the result into the activation function to generate the output value of that layer. The signal is processed through all hidden layers and finally reaches the output layer. The output value of the output layer neurons is the anomaly confidence score of the current event pattern. Based on the anomaly confidence score, a risk probability regression calculation is performed using a historical event database. The structured case data stored in the historical event database includes the anomaly confidence score at the time of the historical anomaly event, the actual rate of event spread, and the scope of the event's final impact. The event spread rate is quantified as the increase rate of the number of affected devices per unit time, and the scope of the event's impact is quantified as the number of substations directly or indirectly affected by the event.

[0045] A regression algorithm is used to fit the mathematical relationship between the anomaly confidence score and the diffusion rate and scope of influence. A multiple linear regression algorithm is employed; to ensure consistency in the formula's dimensions, the variables need to be standardized. The regression equation is established in the following form:

[0046]

[0047] in: Indicates the probability value of risk. This represents the real-time anomaly confidence score. This represents the standardized event propagation rate index, and its calculation method is as follows: ,in It is an indicator of the original diffusion rate. It is the average rate of spread of all cases in the historical event database. It is the standard deviation of the spread rate of all cases in the historical event database. It is the intercept term of the regression equation. It is the anomaly confidence score The regression coefficients, It is a standardized diffusion rate indicator The regression coefficients, It is an interactive item The regression coefficients, It is the random error term of the regression model.

[0048] Estimating the coefficient parameters in the regression equation using the least squares method The least squares method determines the optimal coefficients by minimizing the sum of squared residuals between the predicted value and the actual risk consequences in historical cases. The real-time calculated anomaly confidence score and the standardized event spread rate index are substituted into the regression equation to calculate the output risk probability value. In some embodiments, the case data in the historical event database can be classified according to event type, and different risk probability regression equations can be established for different types of events. In some embodiments, the training of the deep neural network structure can employ regularization techniques such as Dropout or L2 regularization to prevent overfitting. Optionally, the risk probability regression equation can be periodically refitted using newly added historical event case data to maintain the model's timeliness. It is understood that by standardizing the spread rate index, all terms in the regression equation become dimensionless, ensuring dimensional consistency in the formula. In some embodiments, the influence range index can also be processed using a similar standardization method and introduced as an additional independent variable into the regression equation. Standardization not only solves the dimensional consistency problem but also makes variables of different scales comparable, which is beneficial for the stable estimation of regression coefficients.

[0049] Example 4: In specific implementation, the first step in classifying events based on the abnormal risk distribution map is to set a risk probability threshold range. This range is determined based on the power grid safety operation procedures and historical event statistical analysis results. The risk probability value originates from the risk probability value of each event point calculated in the aforementioned examples. The risk probability threshold range divides the continuous range of risk probability into several discrete levels, such as low, medium, and high. Low level corresponds to a risk probability value below 0.3, medium level to a risk probability value between 0.3 and 0.7, and high level to a risk probability value above 0.7. Each level is assigned a color code and a warning level identifier. The color code uses an intuitive color representation: green for low level, yellow for medium level, and red for high level. The warning level identifier uses numerical levels or text descriptions; for example, low level corresponds to warning level 1, medium level to warning level 2, and high level to warning level 3. The results of the event level classification are appended to each event point on the abnormal risk distribution map, forming a risk grading map with level information.

[0050] Based on the event level and location information of the event point, corresponding operation instructions are matched from the handling strategy library. The matching process is based on a rule engine or a similarity calculation algorithm. The rule engine predefines mapping rules between event level, equipment type, geographical location, and operation instruction type. For example, the rule can specify that for high-level events and equipment located on main transmission lines, equipment isolation instructions should be matched first; for medium-level events and equipment located on distribution transformers, parameter adjustment instructions should be matched. The similarity calculation algorithm selects the operation instruction corresponding to the most similar historical case by calculating the cosine similarity or Euclidean distance between the current event features and the case features in the handling strategy library. Operation instructions include parameter adjustment instructions, equipment isolation instructions, or load transfer commands. Parameter adjustment instructions contain specific setpoint modification commands, equipment isolation instructions contain circuit breaker tripping command sequences, and load transfer commands contain target paths for power flow redistribution. The generated handling instruction sequence is an ordered list of operation commands. Each instruction in the handling instruction sequence contains instruction type, target equipment identifier, operation parameter value, and execution timing information. The execution timing information ensures that multiple instructions are executed sequentially according to the necessary logical order and time delay requirements to prevent operation conflicts.

[0051] The construction of the response strategy library is a process of knowledge accumulation and standardization. Collecting historical successful response cases is fundamental. These cases are derived from power grid dispatch operation logs, event report documents, and automation system operation records. Event types include overvoltage, short circuit, and ground fault categories. Equipment status data records the voltage, current, power, and temperature parameters of relevant equipment at the time of the event. Operation data records the specific steps performed by maintenance personnel, such as switching operations, parameter adjustments, and load switching. Clustering algorithms are used to group the cases. K-means clustering or hierarchical clustering algorithms are employed, using event type and equipment status characteristics as cluster feature vectors. Cases with similar characteristics are grouped together to form several typical response patterns. Each typical response pattern represents an effective response method for a type of common abnormal event.

[0052] Standardized instruction templates are developed for each typical handling mode. These templates are defined using a structured scripting language or configuration data format, and include trigger conditions, instruction content, execution parameters, and constraints. Trigger conditions specify the applicable event level and device type combination, instruction content details the specific operation steps and command syntax, execution parameters specify the exact values ​​or ranges of the operation quantities, and constraints list the preconditions and safety verification rules for operation execution. The completed standardized instruction templates are stored in a handling strategy library, typically managed using a database management system, supporting rapid retrieval and template updates based on event attributes. Table 1 shows a simplified set of standardized instruction templates in a handling strategy library, containing typical operation instructions corresponding to different event levels and device types.

[0053] Table 1: Handling Strategy Library Instruction Templates

[0054]

[0055] In some embodiments, the risk probability threshold range can be dynamically adjusted based on the real-time operating conditions of the power grid, for example, appropriately increasing the threshold for higher levels during peak electricity consumption periods. Optionally, the generated disposal instruction sequence can be configured to require confirmation from maintenance personnel before execution, or set to automatic execution mode. It is understood that the completeness and accuracy of the disposal strategy library directly determine the effectiveness of automatically generated disposal instruction sequences. The disposal strategy library needs to be reviewed and updated regularly to incorporate new disposal experience and adapt to changes in the power grid structure.

[0056] See Figure 4This paper demonstrates the dynamic changes in risk probabilities over time for regions A, B, C, D, and E in a knowledge graph-based approach to handling power grid anomalies. Low / medium risk thresholds (red dashed lines) and medium / high risk thresholds (green dashed lines) are also marked. The graph shows significant temporal fluctuations in risk probabilities across regions. For example, region B has a risk probability close to 0.95 during the period 01-0102, placing it in the high-risk range; region C's risk probability approaches 1.0 during the period 01-0200, indicating an extremely high anomaly risk during this period. The risk evolution trends differ across regions. For instance, region E initially has a high risk probability, which drops below 0.2 in the middle period, then fluctuates upwards again in the later period. These risk probability data are derived from multimodal feature extraction and adaptive learning algorithms. The data is obtained by fusing the node degree centrality, edge weight distribution, and temporal evolution characteristics of the event propagation network model, outputting anomaly confidence scores through a deep learning model, and then performing risk probability regression using a historical event database. The risk threshold ranges (0.3 for low / medium, 0.7 for medium / high) in the figure are determined based on power grid safety operation procedures and historical event statistical analysis. They are used to classify event levels and provide a basis for the subsequent automatic generation of response command sequences (such as equipment isolation, parameter adjustment, etc.). This figure intuitively presents the spatiotemporal distribution patterns of abnormal risks in multiple areas of the power grid and is a key visual support for abnormal event level classification and response decisions.

[0057] Example 5: In specific implementation, monitoring power grid topology change events is the trigger condition for real-time updating of the knowledge graph. Power grid topology change events originate from real-time communication messages sent by the power grid energy management system or dispatch automation system, and these messages follow standard protocol formats such as IEC61850 or IEC104. Specific types of power grid topology change events include circuit breaker or disconnector switch position changes, line commissioning or shutdown operations, grid connection and commissioning of new equipment, and decommissioning of old equipment. For example, when the monitoring system detects that circuit breakers CB001 and CB002 at both ends of the 500 kV line L1 connecting substation A and substation B simultaneously change from the closed position to the open position, a topology change event indicating that line L1 has been decommissioned is generated. The monitoring process is implemented through a message parsing program deployed at the data interface. The message parsing program continuously listens to the communication channel, and when it captures a signal containing switch position changes or equipment status changes, it immediately extracts key information from the message. This key information includes the specific equipment identifier that changed, the name of the substation to which the equipment belongs, the type of status change, and the precise timestamp of the event.

[0058] When a device connection change event is identified, the system automatically adjusts the nodes and edges in the knowledge graph. The adjustment operation is based on predefined graph database operation logic, using Neo4j, a database system that supports transaction operations. For the case of adding new equipment to the grid, such as a new photovoltaic power station P1 connected to the 110kV bus M1, the knowledge graph update process first creates a new node in the graph database. The new node's label is defined as "power plant," and its attributes include the device identifier "P1," the device type "photovoltaic power station," and the rated capacity "50MW." Then, a connection edge is established from the new node "P1" to the existing node "bus M1." The connection edge type is defined as "connected to," and its attributes include the voltage level "110kV" and connection point information. For the case of equipment decommissioning, such as an old transformer T1 being removed, the knowledge graph update process first locates the transformer node with the identifier "T1," then deletes all incoming and outgoing edges connected to the transformer node "T1," and finally deletes the transformer node "T1" itself from the graph database. When the connection relationship changes, such as when a line changes from connecting bus M2 to connecting bus M3, the knowledge graph update process first deletes the old connection edge between the line node and the bus node "M2", and then creates a new connection edge between the line node and the bus node "M3".

[0059] In practice, recalculating propagation path strength is a necessary step after updating the knowledge graph. The recalculation process is based on the updated knowledge graph topology, and the propagation path strength calculation covers all potentially affected device node pairs. The electrical distance between event points is calculated by querying the equivalent impedance values ​​between device nodes in the updated knowledge graph. These equivalent impedance values ​​are derived from the power grid offline calculation database or real-time state estimation results. The topology hop count is calculated by performing a shortest path query algorithm on the graph database, such as using a breadth-first search algorithm to calculate the number of edges traversed by the shortest path between two device nodes. Finally, path strength is quantified by incorporating device type weights. These weights are a pre-defined static parameter table; for example, the weight coefficient for generator nodes is 1.0, for 500 kV transmission line nodes it is 0.9, for 220 kV transmission line nodes it is 0.7, for main transformer nodes it is 0.8, and for distribution transformer nodes it is 0.5. The path strength quantification formula uses a weighted calculation method, for example, path strength = (equipment type weight coefficient A + equipment type weight coefficient B) / (electrical distance × topology hop count). A new propagation path strength matrix is ​​generated. This matrix can be symmetric or asymmetric, with row and column indices corresponding to device node identifiers in the knowledge graph, and the values ​​of the matrix elements representing the path strength of the corresponding node pair. In some embodiments, the calculation of electrical distance can consider the actual length and impedance parameters of the line. Optionally, the calculation of the topology hop count can be limited to a certain range to improve computational efficiency.

[0060] The real-time knowledge graph update process can be configured with different execution modes. One mode is periodic, timed execution, where the system automatically initiates a complete knowledge graph topology verification and propagation path strength recalculation process every 5 minutes, regardless of whether a power grid topology change event is detected during this period. Another mode is event-triggered, immediate execution; once a valid power grid topology change event is detected, the system immediately interrupts the current task and prioritizes knowledge graph adjustment and propagation path strength recalculation. It can be understood that event-triggered updates offer better real-time performance, while periodic updates help identify and correct subtle changes that may be missed during monitoring. The results of the update process are persisted to the graph database and the event propagation network model generation module is notified. This module will then perform subsequent analysis based on the latest knowledge graph structure and propagation path strength. Optionally, during the knowledge graph update process, the system can record detailed change logs, including change time, change content, pre-change status, and post-change status, for auditing and fault backtracking. In some embodiments, for large-scale complex power grids, incremental computing techniques can be used to recalculate only the propagation path strength within the local network area directly affected by topology changes, rather than recalculating the entire network, in order to improve update efficiency.

[0061] See Figure 5 The graph compares the computation time of incremental and full computation methods, plotting network size (100 nodes, 500 nodes, 1000 nodes, 5000 nodes, 10000 nodes) on the horizontal axis and computation time (in seconds) on the vertical axis (using a logarithmic scale). As the graph shows, with the increase in network size, the computation time for both incremental and full computation increases, with the increase for full computation being significantly greater than that for incremental computation. At 100 nodes, full computation takes approximately 2 seconds, while incremental computation takes less than 1 second. When the network size reaches 10000 nodes, full computation takes nearly 1000 seconds, while incremental computation takes approximately 60 seconds. This indicates that in scenarios involving large-scale network computation, such as power grid anomaly event handling based on knowledge graphs, incremental computation technology can significantly reduce the computational overhead caused by network size expansion. Its efficiency advantage is particularly pronounced when the network size is large, effectively improving the real-time performance and scalability of the system when handling tasks such as power grid topology changes and event propagation path calculations.

[0062] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0063] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for handling abnormal power grid events based on knowledge graphs, characterized in that, The method performs the following operations in sequence: real-time acquisition of time-series data streams and spatial coordinate information of abnormal power grid events through multi-source sensing devices, and construction of a dynamic event data pool by integrating device operating parameters; Based on the topological connections of knowledge graphs, the dynamic event data pool is transformed into a graph structure, the propagation path strength between event nodes is calculated, and an event propagation network model is generated. Multimodal feature extraction technology is used to extract key anomaly indicators from the event propagation network model, and an adaptive learning algorithm is used to calculate the risk probability and output an anomaly risk distribution map. The event levels are classified based on the abnormal risk distribution map, and a sequence of handling instructions is automatically generated.

2. The method for handling abnormal power grid events based on knowledge graphs according to claim 1, characterized in that, The specific process of constructing a dynamic event data pool by real-time acquisition of time-series data streams and spatial coordinate information of abnormal power grid events through multi-source sensing devices and fusion of device operating parameters includes: obtaining the timestamp sequence and geographic coordinate set of abnormal events from the power grid monitoring platform; synchronously acquiring voltage waveform data, current phase data, and load fluctuation data of related devices; aligning and buffering the acquisition results according to time windows to generate raw event stream data; performing data cleaning on the raw event stream data, including removing outliers, compensating for missing points, and smoothing filtering, and unifying the data sampling frequency and dimensions to obtain standardized event data groups; associating and mapping the standardized event data groups with device identifiers; and integrating multi-dimensional parameters through a data fusion engine to form a dynamic event data pool.

3. The method for handling abnormal power grid events based on knowledge graphs according to claim 2, characterized in that, The specific process of transforming the dynamic event data pool into a graph structure based on the knowledge graph-based topological connection relationship, calculating the propagation path strength between event nodes, and generating an event propagation network model includes: extracting the device number and location coordinates of each event point from the dynamic event data pool; constructing an edge connection set between event points according to the node connection relationship in the knowledge graph; calculating the electrical distance and topological hop count between each pair of event points; quantifying the path strength by combining the device type weights to generate a propagation path strength matrix; and constructing a graph structure with event points as nodes and path strength as edge weights based on the propagation path strength matrix, and adding time dimension labels to form an event propagation network model.

4. The method for handling abnormal power grid events based on knowledge graphs according to claim 3, characterized in that, The specific process of extracting key anomaly indicators from the event propagation network model using multimodal feature extraction technology, and calculating risk probability using an adaptive learning algorithm to output an anomaly risk distribution map includes: extracting node degree centrality features, edge weight distribution features, and temporal evolution features from the event propagation network model; performing feature normalization and dimensionality reduction to obtain a fused feature vector; using a deep learning model to perform anomaly pattern recognition on the fused feature vector and outputting an anomaly confidence score for each event point; performing risk probability regression calculation based on the anomaly confidence score and a historical event database to generate a risk probability value for each event point; and mapping the risk probability value to the power grid geographic space to generate an anomaly risk distribution map.

5. The method for handling abnormal power grid events based on knowledge graphs according to claim 4, characterized in that, The detailed steps for using a deep learning model to perform anomaly pattern recognition on fused feature vectors include: constructing a deep neural network structure, where the input layer receives the fused feature vectors, the hidden layer performs feature transformation and nonlinear activation, and the output layer generates anomaly confidence scores; optimizing network parameters using a backpropagation algorithm, and using historical anomaly event data as training samples for model training; inputting the real-time fused feature vectors into the trained model, and calculating the anomaly confidence scores.

6. The method for handling abnormal power grid events based on knowledge graphs according to claim 4, characterized in that, The detailed steps for risk probability regression calculation based on anomaly confidence scores and historical event databases include: retrieving case data with similar anomaly patterns from the historical event database and extracting the event spread speed and impact range indicators from the cases; using a regression algorithm to fit the relationship between the anomaly confidence score and the spread speed and impact range to obtain a risk probability calculation function; inputting the real-time anomaly confidence score into the risk probability calculation function and outputting the risk probability value.

7. The method for handling abnormal power grid events based on knowledge graphs according to claim 1, characterized in that, The specific process of classifying events into levels based on the abnormal risk distribution map and automatically generating a sequence of handling instructions includes: setting a risk probability threshold range and dividing the risk probability values ​​in the abnormal risk distribution map into three levels: low, medium, and high; assigning color codes and warning level identifiers to each level; and matching corresponding operation instructions from the handling strategy library based on the event level and location information, including parameter adjustment, equipment isolation, or load transfer commands, to generate a sequence of handling instructions.

8. The method for handling abnormal power grid events based on knowledge graphs according to claim 7, characterized in that, The process of constructing the disposal strategy library includes: collecting historical successful disposal cases, extracting event type, equipment status and operation data from the cases; grouping the cases using a clustering algorithm to form typical disposal patterns; and writing standardized instruction templates for each pattern and storing them as the disposal strategy library.

9. The method for handling abnormal power grid events based on knowledge graphs according to claim 1, characterized in that, The method also includes the step of updating the knowledge graph in real time: monitoring power grid topology change events, automatically adjusting the nodes and edges in the knowledge graph when the device connection relationship changes, and recalculating the propagation path strength.

10. A knowledge graph-based power grid anomaly event handling system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the knowledge graph-based power grid abnormal event handling method according to any one of claims 1 to 9.

Images