A tamper-proof detection method and system for electric energy meter with behavior characteristics recognition

Abstract

This invention discloses a method and system for tamper-proof detection of electricity meters based on behavioral feature recognition, relating to the field of electricity meter technology. The method includes: collecting historical tampering datasets of electricity meters, extracting and labeling behavioral features to obtain a multi-dimensional normal behavior feature set and a multi-dimensional abnormal behavior feature set; setting a sensitivity threshold, and constructing an abnormal behavior evaluation model by evaluating the degree of abnormality of the multi-dimensional normal behavior feature set and the multi-dimensional abnormal behavior feature set; building an electricity meter tampering pattern detection tree, and merging and iteratively optimizing it with the abnormal behavior evaluation model to generate an electricity meter tamper-proof detection channel; real-time monitoring of electricity meter operating characteristic data, and performing tamper-proof detection on the electricity meter operating characteristic data based on the electricity meter tamper-proof detection channel to determine the electricity meter tamper-proof detection result. This invention solves the technical problem of insufficient accuracy in electricity meter tamper-proof detection in existing technologies, achieving the technical effect of improving the accuracy of electricity meter tamper-proof detection.

Description

Technical Field

[0001] This invention relates to the field of electricity meter technology, and specifically to an electricity meter anti-tampering detection method and system based on behavioral feature recognition. Background Technology

[0002] Traditional methods for detecting electricity meter tampering often rely on single threshold judgments or physical anti-theft measures, making it difficult to effectively capture the complex and ever-changing characteristics of tampering behavior. In actual operation, electricity meter operating data is easily affected by environmental factors and load fluctuations, blurring the boundary between normal and abnormal behavior. Simple detection rules are prone to missed detections or false alarms. Furthermore, the methods do not fully utilize the behavioral characteristics in historical tampering data and lack the ability to comprehensively assess the degree of anomaly and tampering patterns, making the overall accuracy of tampering detection insufficient to meet practical application requirements. Summary of the Invention

[0003] This application provides a method and system for detecting tampering of electricity meters based on behavioral feature recognition, which addresses the technical problem of insufficient accuracy in the detection of tampering of electricity meters in the prior art.

[0004] In view of the above problems, this application provides a method and system for tamper-proof detection of electricity meters based on behavioral feature recognition.

[0005] The first aspect of this application provides a method for tamper-proof detection of electricity meters based on behavioral feature recognition, the method comprising:

[0006] A historical tampering dataset of electricity meters is collected. Behavioral features are extracted and labeled from this dataset to obtain a multi-dimensional normal behavior feature set and a multi-dimensional abnormal behavior feature set. Based on the tamper-proof requirements of the electricity meters, a sensitivity threshold is preset. An abnormality assessment model is constructed by evaluating the degree of abnormality in the multi-dimensional normal behavior feature set and the multi-dimensional abnormal behavior feature set based on the sensitivity threshold. An electricity meter tampering pattern detection tree is built. The abnormal behavior assessment model and the electricity meter tampering pattern detection tree are then cascaded, merged, and iteratively optimized to generate an electricity meter tamper-proof detection channel. The electricity meter's operating characteristic data is monitored in real time. Based on the electricity meter tamper-proof detection channel, the operating characteristic data is subjected to tamper-proof detection to determine the electricity meter tamper-proof detection result.

[0007] A second aspect of this application provides a tamper-proof detection system for electricity meters based on behavioral feature recognition, the system comprising:

[0008] The data acquisition module is used to collect historical tampering datasets of electricity meters, extract and label behavioral features from the datasets to obtain multi-dimensional normal behavior feature sets and multi-dimensional abnormal behavior feature sets. The evaluation and modeling module is used to preset sensitivity thresholds based on the anti-tampering requirements of the electricity meters, and to perform anomaly assessment and modeling on the multi-dimensional normal behavior feature sets and multi-dimensional abnormal behavior feature sets based on these thresholds, thus constructing an abnormal behavior assessment model. The channel generation module is used to build an electricity meter tampering pattern detection tree, and to concatenate, merge, and iteratively optimize the abnormal behavior assessment model and the electricity meter tampering pattern detection tree to generate an electricity meter anti-tampering detection channel. The anti-tampering detection module is used to monitor the electricity meter's operating characteristic data in real time, perform anti-tampering detection on the operating characteristic data based on the anti-tampering detection channel, and determine the electricity meter anti-tampering detection result.

[0009] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0010] This application collects historical tampering datasets of electricity meters, extracts and labels behavioral features from these datasets to obtain multi-dimensional normal behavior feature sets and multi-dimensional abnormal behavior feature sets. Based on the anti-tampering requirements of electricity meters, a preset sensitivity threshold is established. An anomaly assessment model is constructed based on this threshold to evaluate the degree of abnormality in the multi-dimensional normal behavior feature sets and multi-dimensional abnormal behavior feature sets. An electricity meter tampering pattern detection tree is built, and the abnormal behavior assessment model and the electricity meter tampering pattern detection tree are cascaded, merged, and iteratively optimized to generate an electricity meter anti-tampering detection channel. The working characteristic data of the electricity meter is monitored in real time, and anti-tampering detection is performed on the working characteristic data based on the electricity meter anti-tampering detection channel to determine the electricity meter anti-tampering detection result. This invention solves the technical problem of insufficient accuracy in electricity meter tampering detection in existing technologies. By collecting historical tampering datasets and extracting and labeling multi-dimensional behavioral features, constructing an abnormal behavior assessment model and building a tampering pattern detection tree, and cascading and merging these two models iteratively optimizing them to generate an anti-tampering detection channel, the technical effect of improving the accuracy of electricity meter anti-tampering detection is achieved. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This application provides a schematic flowchart of a method for preventing tampering with electricity meters based on behavioral feature recognition, as an embodiment of the present application.

[0013] Figure 2 This is a schematic diagram of a behavioral feature recognition-based anti-tampering detection system for electricity meters, provided in an embodiment of this application.

[0014] Figure labeling: Data acquisition module 11, evaluation modeling module 12, channel generation module 13, anti-tampering detection module 14. Detailed Implementation

[0015] This application provides a method and system for tamper-proof detection of electricity meters based on behavioral feature recognition. Addressing the technical problem of insufficient accuracy in existing electricity meter tamper-proof detection technologies, this method collects historical tamper-proof datasets, extracts and annotates multi-dimensional behavioral features, constructs an abnormal behavior evaluation model, and builds a tamper-proof pattern detection tree. These two models are then cascaded, merged, and iteratively optimized to generate an tamper-proof detection channel, thereby improving the accuracy of electricity meter tamper-proof detection.

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0017] It should be noted that any variation of the terms "comprising" and "having" is intended to cover non-exclusive inclusion, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such processes, methods, products, or devices.

[0018] Example 1, as Figure 1 As shown, this application provides a method for tamper-proof detection of electricity meters based on behavioral feature recognition, the method comprising:

[0019] Step S100: Collect the historical tampering dataset of the electricity meter, extract and label the behavioral features of the historical tampering dataset of the electricity meter to obtain a multidimensional normal behavior feature set and a multidimensional abnormal behavior feature set.

[0020] In this embodiment of the application, historical operating data of the electricity meter under various known tampering scenarios and normal operating conditions are first collected from the historical database to form a historical tampering dataset of the electricity meter. The historical tampering dataset of the electricity meter specifically includes the operating status data of the electricity meter at different time points, such as voltage, current, power factor, and frequency, active / reactive energy metering readings, as well as external operation records such as cover opening records, phase loss records, voltage loss records, reverse phase sequence records, parameter modification instructions, time synchronization operations, and programming button operations.

[0021] Next, behavioral features are extracted and labeled from the historical tampering dataset of electricity meters. This process involves first cleaning and extracting behavioral features from the dataset to obtain a set of electricity meter-related behavioral features. Then, based on the tampering type and characteristics, electricity meter behavior labeling rules are determined. Following these rules, the electricity meter-related behavioral feature set is proportionally labeled and trained for classification to construct an electricity meter behavior classifier. Finally, the labeling of the electricity meter-related behavioral feature set is corrected based on the electricity meter behavior classifier, resulting in a multi-dimensional normal behavior feature set and a multi-dimensional abnormal behavior feature set.

[0022] Furthermore, the method provided in the application embodiment, which extracts and labels behavioral features from the historical tampering dataset of the electricity meter to obtain a multidimensional normal behavior feature set and a multidimensional abnormal behavior feature set, also includes:

[0023] The historical tampering dataset of the electricity meters is cleaned and behavioral features are extracted to obtain a set of electricity meter-related behavioral features. Based on the tampering type and characteristics, electricity meter behavior labeling rules are determined. The electricity meter-related behavioral feature set is proportionally labeled and classified according to the labeling rules to construct an electricity meter behavior classifier. Based on the electricity meter behavior classifier, the labeling of the electricity meter-related behavioral feature set is corrected to obtain a multi-dimensional normal behavior feature set and a multi-dimensional abnormal behavior feature set.

[0024] In this embodiment, for the historical tampering dataset of electricity meters, data cleaning is first performed. This involves using median filtering to eliminate impulse noise in voltage and current time-series signals, using linear interpolation to fill in missing values ​​caused by communication packet loss, and deleting duplicate records based on a timestamp deduplication algorithm. Then, behavioral features are extracted from the cleaned data. The sliding window method is used to calculate statistical features such as mean, variance, kurtosis, and skewness within each window. For example, the window length is set to 128 sampling points and the step size is 64 sampling points. At the same time, frequency domain energy spectrum features are extracted using fast Fourier transform, and time-series correlation features are extracted from the time sequence of opening records and parameter modification commands, such as the time interval between two operations. Finally, the electricity meter-related behavioral feature set is obtained.

[0025] Next, based on the pre-collected types and characteristics of electricity meter tampering, namely the range of change, rate of change and triggering sequence of characteristic parameters such as voltage, current and power factor under each type of tampering, including tampering types such as strong magnetic interference, bypass electricity theft, high-frequency pulse injection and clock tampering, and combined with the standard thresholds when the electricity meter is operating normally, the electricity meter behavior labeling rules are determined. These rules include the characteristic boundaries of the normal state, the characteristic criteria for various types of tampering, and the principles for assigning fuzzy areas.

[0026] Subsequently, the energy meter-related behavior feature set was proportionally labeled according to the energy meter behavior labeling rules. This involved pre-setting the labeling ratio based on the frequency of normal samples and various tampering samples in actual operating conditions; for example, normal samples accounted for 75%, and tampering samples accounted for 25% in total. Each sample was then assigned an initial category label based on the energy meter behavior labeling rules, such as 0 for normal, 1 for strong magnetic interference, 2 for bypass electricity theft, 3 for high-frequency pulse injection, and 4 for clock tampering. Then, a support vector machine was used as the base classifier for classification training. The energy meter-related behavior feature set was divided into a training set and a validation set in an 8:2 ratio. The dataset contains 2400 normal samples and 800 tampered samples, including 300 cases of strong magnetic interference, 200 cases of bypass electricity theft, 150 cases of high-frequency pulse injection, and 150 cases of clock tampering. Each sample's 256-dimensional feature vector is used as input, and the initial class label is used as the supervision signal. A radial basis function kernel is employed, and the penalty coefficient C and kernel parameter γ are optimized using a grid search method. For example, the penalty coefficient C is searched within the range of 0.1 to 100, and the kernel parameter γ is searched within the range of 0.001 to 10. The average classification accuracy of five-fold cross-validation is used as the objective function to learn the nonlinear mapping relationship between features and tampering types, ultimately constructing an electricity meter behavior classifier.

[0027] Finally, the annotation of the energy meter associated behavior feature set is corrected based on the energy meter behavior classifier. In this process, the associated behavior feature set is input into the energy meter behavior classifier to obtain the predicted category and corresponding confidence score for each sample. The confidence score is the maximum category probability value output by the energy meter behavior classifier. For samples whose prediction results are inconsistent with the initial annotation, if the confidence score is higher than a preset threshold of 0.85, the predicted category is used as the corrected annotation; otherwise, the initial annotation is retained. After the above correction, the annotations of all samples are unified and corrected, ultimately yielding a multidimensional normal behavior feature set and a multidimensional abnormal behavior feature set.

[0028] Step S200: Based on the anti-tampering requirements of the electricity meter, a sensitivity threshold is preset, and an anomaly assessment model is constructed by evaluating the degree of anomaly of the multidimensional normal behavior feature set and the multidimensional abnormal behavior feature set based on the sensitivity threshold.

[0029] In this embodiment of the application, a preset sensitivity threshold is first extracted from the pre-stored anti-tampering requirements of the electricity meter.

[0030] Next, based on sensitivity thresholds, anomaly assessment modeling is performed on the multidimensional normal behavior feature set and the multidimensional abnormal behavior feature set. In this process, firstly, a transfer learning mechanism is introduced to perform baseline supervised modeling of the multidimensional normal behavior feature set, generating a normal behavior baseline model; then, the multidimensional abnormal behavior feature set is input into the normal behavior baseline model for comparison, obtaining the abnormal behavior deviation feature set; next, based on sensitivity thresholds, the abnormality degree of the abnormal behavior deviation feature set is assessed and labeled, obtaining an abnormal behavior feature degree sample set; finally, a deep neural network is used to train and model the abnormality degree of the abnormal behavior feature degree sample set, constructing an abnormal behavior assessment model.

[0031] Furthermore, the method provided in the application embodiments, in constructing the abnormal behavior evaluation model, further includes:

[0032] A transfer learning mechanism is introduced to perform benchmark-supervised modeling of the multidimensional normal behavior feature set, generating a normal behavior baseline model; the multidimensional abnormal behavior feature set is input into the normal behavior baseline model for comparison, obtaining an abnormal behavior deviation feature set; the abnormality degree of the abnormal behavior deviation feature set is evaluated and identified based on the sensitivity threshold, obtaining an abnormal behavior feature degree sample set; a deep neural network is used to train and model the abnormality degree of the abnormal behavior feature degree sample set, constructing an abnormal behavior evaluation model.

[0033] In this embodiment, a transfer learning mechanism is first introduced to perform benchmark supervised modeling of a multidimensional normal behavior feature set. Specifically, source domain data of electricity meter behavior is selected according to the transfer learning mechanism, and model selection training is performed based on the characteristic information of the source domain data of electricity meter behavior to construct a source domain behavior pre-trained model. Next, a model transfer strategy is designed, which includes feature transfer and architecture fine-tuning. Then, the model transfer strategy is used to perform transfer training modeling on the multidimensional normal behavior feature set based on the source domain behavior pre-trained model to obtain an initial behavior baseline model. Finally, the performance of the initial behavior baseline model is evaluated and optimized to generate a normal behavior baseline model.

[0034] Next, the multidimensional abnormal behavior feature set is input into the normal behavior baseline model for comparison. Specifically, each abnormal sample in the multidimensional abnormal behavior feature set is input into the normal behavior baseline model according to the same data format as during the training phase, with each sample being a 256-dimensional feature vector. The feature vector output by the feature extraction layer in the normal behavior baseline model is read as the mapping result for that sample. This feature extraction layer maps the 256-dimensional input into a 64-dimensional feature vector. Simultaneously, the same operation is performed on all normal samples in the multidimensional normal behavior feature set: each normal sample is input into the normal behavior baseline model, and the output of the same feature extraction layer is read. Then, the average of these normal sample output vectors is calculated to obtain a 64-dimensional normal reference vector. For each abnormal sample, the Euclidean distance between its 64-dimensional mapping result and the 64-dimensional normal reference vector is calculated. This is done by squaring the differences in each of the 64 dimensions, summing them, and then taking the square root to obtain a single scalar distance value. Furthermore, the absolute values ​​of the differences between the mapping result and the normal reference vector in each of the 64 dimensions are calculated dimension by dimension, resulting in 64 dimension-wise differences. By combining multiple anomalous samples collected within a continuous time window, the changes in Euclidean distance between adjacent samples and the changes in 64 sequential differences are calculated to form the difference change within the time window. The obtained Euclidean distance, 64 sequential differences, and difference change within the continuous time window are combined as the deviation representation result for a single anomalous sample. After performing the above operations on all anomalous samples, the results are summarized to obtain the anomalous behavior deviation feature set. Each sample in this feature set contains an Euclidean distance scalar, 64 sequential difference scalars, and several time window change scalars, used to quantitatively describe the degree of deviation of the multidimensional anomalous behavior feature set from the normal behavior baseline model.

[0035] Then, the degree of anomalousness of the deviation feature set of abnormal behavior is assessed and identified based on sensitivity thresholds. In this process, firstly, the distribution range of Euclidean distance of normal samples is statistically analyzed using the comparison results obtained from the normal behavior baseline model through the multidimensional normal behavior feature set, and multiple sensitivity thresholds are set in conjunction with the anti-tampering requirements of the electricity meter. Specifically, the 95th percentile value of the Euclidean distance distribution of normal samples is set as the first sensitivity threshold T1, the 99th percentile value as the second sensitivity threshold T2, and the 99.9th percentile value as the third sensitivity threshold T3. For example, when the statistical results show that the 95th percentile value is 2.10, the 99th percentile value is 2.85, and the 99.9th percentile value is 3.60, then T1 is set to 2.10, T2 to 2.85, and T3 to 3.60, respectively. Subsequently, for each sample in the abnormal behavior deviation feature set, its main deviation amount, i.e., the Euclidean distance, is taken and compared with the above three thresholds one by one. If the Euclidean distance is less than T1, the sample is identified as a low-level anomaly, and the corresponding anomaly level label is set to 0. If the Euclidean distance is greater than or equal to T1 and less than T2, it is identified as a Level 1 anomaly, and the label is set to 1. If the Euclidean distance is greater than or equal to T2 and less than T3, it is identified as a Level 2 anomaly, and the label is set to 2. If the Euclidean distance is greater than or equal to T3, it is identified as a Level 3 anomaly, and the label is set to 3. For samples that simultaneously contain Euclidean distance, the mean of 64 sequential differences, and the change in time window, these three parameters are first normalized to a range of 0 to 1. Then, they are weighted and summed according to preset weights, for example, the weight of Euclidean distance is 0.5, the weight of the mean of sequential differences is 0.3, and the weight of the change in time window is 0.2, resulting in a unified electricity meter anomaly index. Then, the level is determined based on the score range corresponding to T1, T2, and T3. After the level is determined, each sample is assigned a corresponding anomaly level label, thus obtaining a sample set of abnormal behavior characteristic levels. Each data point in this sample set contains abnormal behavior deviation features and corresponding abnormality level labels from 0 to 3, which can be directly used for subsequent supervised training.

[0036] Finally, a deep neural network is used to train and model the abnormal behavior feature set to construct an abnormal behavior evaluation model. Specifically, a multi-layer fully connected deep neural network is constructed. The input layer dimension is determined according to the dimension of the abnormal behavior deviation features. When the input features of each sample consist of one Euclidean distance, 64 sequential differences, and three time window changes, the input layer dimension is set to 68 dimensions. Three hidden layers are set: the first hidden layer contains 128 neurons, uses ReLU activation function, and is followed by a Dropout layer with a dropout rate of 0.3; the second hidden layer contains 64 neurons, uses ReLU activation function, and also adds a Dropout layer with a dropout rate of 0.3; the third hidden layer contains 32 neurons, uses ReLU activation function. The output layer contains one neuron, uses Sigmoid activation function, and the output range is 0 to 1. This output value is the electricity meter abnormality index, used to quantitatively characterize the degree to which the current behavior deviates from the normal operating state. The abnormality level labels (0 for low-level abnormality, 0.33 for level 1, 0.67 for level 2, and 1 for level 3) in the abnormal behavior feature level sample set are used as the regression target. The abnormal behavior feature level sample set is then randomly divided into training, validation, and test sets in an 8:1:1 ratio. During training, the mean squared error loss function is used, the Adam optimizer is used, the initial learning rate is set to 0.001, the batch size is set to 64, and the training epochs are set to 100. In each epoch, the training set is input into the network in batches, the loss is calculated via forward propagation, the weights are updated via backpropagation, and the loss value is calculated using the validation set after each epoch. An early stopping strategy is implemented: training is terminated early when the validation set loss no longer decreases for 10 consecutive epochs. After training, the model performance is evaluated using the test set, and the mean absolute error and coefficient of determination between the predicted abnormality index and the true label are calculated. If the mean absolute error is less than 0.05 and the coefficient of determination is greater than 0.95, the current network parameters are saved as the final model; otherwise, the network structure or hyperparameters are adjusted and retrained. This process ultimately leads to the construction of an abnormal behavior assessment model, which can directly output an abnormality index of the electricity meter in the range of 0 to 1 from the input electricity meter operating characteristic data.

[0037] Furthermore, the method provided in the application embodiment, which introduces a transfer learning mechanism to perform benchmark-supervised modeling of the multidimensional normal behavior feature set and generate a normal behavior baseline model, also includes:

[0038] Source domain data of electricity meter behavior is selected based on the transfer learning mechanism. Model selection and training are performed based on the characteristic information of the source domain data of electricity meter behavior to construct a source domain behavior pre-trained model. A model transfer strategy is designed, which includes feature transfer and architecture fine-tuning. The model transfer strategy is used to perform transfer training and modeling on the multidimensional normal behavior feature set based on the source domain behavior pre-trained model to obtain an initial behavior baseline model. The performance of the initial behavior baseline model is evaluated and optimized to generate a normal behavior baseline model.

[0039] In this embodiment, when selecting source domain data for electricity meter behavior based on the transfer learning mechanism, historical operating data of other electricity meters of the same model as the current target electricity meter under normal operating conditions are acquired, including time-series signals such as voltage, current, and power factor. The sampling frequency is set to once per second, and continuous collection is performed for 30 days to form source domain data for electricity meter behavior. Model selection and training are performed based on the characteristic information of the source domain data for electricity meter behavior. The characteristic information includes a data dimension of 256 dimensions, a sampling interval of 1 second, and a normal state fluctuation range. A deep neural network with an encoder-decoder structure is selected as the basic model. The encoder part is set with an input layer of 256 dimensions, a first hidden layer of 128 dimensions, a second hidden layer of 64 dimensions, and a bottleneck layer of 32 dimensions. The decoder part is set with 32 dimensions, 64 dimensions, 128 dimensions, and an output layer of 256 dimensions. The activation function is ReLU for all layers, and linear activation is used for the output layer. Unsupervised pre-training was performed using source domain data of electricity meter behavior with the goal of minimizing reconstruction error. The loss function was mean squared error, the optimizer was Adam, the learning rate was set to 0.001, the batch size was set to 64, and the training epochs were set to 200. In each epoch, the reconstruction error of the source domain data of electricity meter behavior was calculated and backpropagated to update the network parameters, and finally the source domain behavior pre-trained model was obtained.

[0040] Subsequently, a model transfer strategy was designed, which included feature transfer and architecture fine-tuning. Specifically, the weight parameters of the first two layers (128-dimensional and 64-dimensional) of the encoder in the source domain behavior pre-trained model were directly copied to the corresponding layers of the normal behavior baseline model to be built, and these parameters were fixed and not updated in subsequent training. Architecture fine-tuning involved initializing the weight parameters of the third layer (bottleneck layer) of the encoder and all layers of the decoder in the normal behavior baseline model to the values ​​of the corresponding layers in the source domain behavior pre-trained model, but allowing updates in subsequent training; simultaneously, the output layer of the normal behavior baseline model to be built was kept at 256 dimensions, and the loss function remained the mean squared error.

[0041] Next, a model transfer strategy is used to perform transfer training on the multidimensional normal behavior feature set based on the source domain behavior pre-trained model. Each sample and each 256-dimensional feature from the multidimensional normal behavior feature set is input into the normal behavior baseline model to be constructed. Forward propagation calculates the mean squared error between the reconstructed output and the original input as the loss value. Mini-batch gradient descent is used for parameter updates, with a batch size of 32, a learning rate of 0.0005, and the optimizer remaining Adam. In each training round, all samples are input in batches, the loss is calculated, and backpropagation is performed. Only the parameters that can be fine-tuned, namely the bottleneck layer and decoder weights, are updated; fixed parameters are not updated. A total of 100 rounds of training are performed. After each round, the average reconstruction error on the entire training set is calculated. Training stops when the average reconstruction error decreases by less than 0.001 for 10 consecutive rounds, yielding the initial behavior baseline model.

[0042] Next, the initial behavioral baseline model was evaluated and optimized. The multidimensional normal behavior feature set was randomly divided into a training subset and a validation subset in an 8:2 ratio. The model was retrained using the training subset following the transfer training process described above. After each round of training, the mean and standard deviation of the reconstruction error were calculated using the validation subset. The model parameters with the lowest mean reconstruction error in the validation set were recorded as candidate models. If the mean reconstruction error in the validation set was less than 0.02 and the standard deviation was less than 0.015, the candidate model was accepted as the final normal behavior baseline model; otherwise, the network structure parameters were adjusted, for example, by changing the bottleneck layer dimension from 32 to 64 dimensions or increasing the number of encoder layers, and the transfer training and evaluation were repeated until the performance requirements were met, finally generating the normal behavior baseline model.

[0043] Step S300: Build an electricity meter tampering mode detection tree, and connect and iteratively optimize the abnormal behavior evaluation model and the electricity meter tampering mode detection tree to generate an electricity meter anti-tampering detection channel.

[0044] In this embodiment, when constructing the electricity meter tampering pattern detection tree, an electricity meter tampering pattern system is defined. The multi-dimensional abnormal behavior feature set is then classified according to this system to obtain an abnormal behavior tampering pattern feature set. Next, the normality of the electricity meter's behavior features is used as the initial tampering judgment point, which is set as the root node. Subsequently, based on the electricity meter tampering pattern system and the root node, a tampering detection tree architecture is designed, including multi-level branches of tampering patterns and leaf nodes representing tampering pattern types. Finally, based on the tampering detection tree architecture, a cascaded judgment analysis is performed on the abnormal behavior tampering pattern feature set to construct the electricity meter tampering pattern detection tree.

[0045] When merging and iteratively optimizing the abnormal behavior assessment model and the electricity meter tampering mode detection tree in series, an anomaly degree benchmark is preset, and the activation layer of the detection tree is determined based on the anomaly degree benchmark. Then, the abnormal behavior assessment model and the electricity meter tampering mode detection tree are merged in series according to the activation layer of the detection tree to obtain the initial anti-tampering detection channel. Finally, the initial anti-tampering detection channel is iteratively tested and optimized to generate the electricity meter anti-tampering detection channel.

[0046] Furthermore, in the method provided in the application embodiments, building the electricity meter tampering pattern detection tree further includes:

[0047] A tampering pattern system for electricity meters is defined. The multi-dimensional abnormal behavior feature set is then classified according to this system to obtain an abnormal behavior tampering pattern feature set. The normality of the electricity meter's behavior features is used as the initial tampering judgment point, which is set as the root node. Based on the tampering pattern system and the root node, a tampering detection tree architecture is designed, including multi-level branches for tampering patterns and leaf nodes for tampering pattern types. A cascaded judgment analysis is performed on the abnormal behavior tampering pattern feature set based on the tampering detection tree architecture to construct the electricity meter tampering pattern detection tree.

[0048] In this embodiment, a system of electricity meter tampering modes is first defined, and the multi-dimensional abnormal behavior feature set is classified according to this system. First, based on common tampering methods in existing electricity meter anti-theft scenarios, the electricity meter tampering mode system is determined. This system includes strong magnetic interference, bypass theft, high-frequency pulse injection, clock tampering, terminal reversal, and abnormal parameter modification. Strong magnetic interference refers to metering anomalies caused by external magnetic fields; bypass theft refers to under-metering by bypassing the metering circuit; high-frequency pulse injection refers to interfering with metering by inputting abnormal high-frequency signals; clock tampering refers to modifying clock parameters to affect frozen data and billing periods; terminal reversal refers to abnormal wiring direction; and abnormal parameter modification refers to manually rewriting metering parameters. Then, the corresponding behavioral feature range and quantitative criteria are compiled for each tampering mode. For example, strong magnetic interference corresponds to the occurrence of a magnetic field alarm record, with a current drop exceeding 30% of the normal load fluctuation range and a voltage change of less than 5%; bypass power theft corresponds to a current drop exceeding 40%, a voltage change of less than 5%, and a power factor drop exceeding 0.2; clock tampering corresponds to a cumulative clock offset exceeding 5 minutes within 24 hours; high-frequency pulse injection corresponds to a voltage harmonic content exceeding 8% and a pulse count exceeding 10 times per minute; terminal reverse connection corresponds to a current phase offset exceeding 15 degrees; abnormal parameter modification corresponds to parameter modification exceeding 3 times per hour and parameter values ​​before and after modification exceeding a preset threshold. These criteria are organized into a rule table, with each rule including a feature name, comparison direction, and threshold. Next, each abnormal sample in the multidimensional abnormal behavior feature set is compared sequentially with the feature criteria of each tampering mode, and the number of features that each sample meets for each tampering mode is counted. For each sample, the number of matches with each tampering mode is calculated. If a sample meets the most characteristic conditions of strong magnetic interference and exceeds at least two of the other modes, it is classified as strong magnetic interference; if it meets the most characteristic conditions of bypass power theft and exceeds at least two of the other modes, it is classified as bypass power theft, and so on. If two or more modes have the same number of matching items and all are the highest, they are judged according to a preset priority, in the following order: strong magnetic interference, bypass power theft, high-frequency pulse injection, clock tampering, terminal reverse connection, and abnormal parameter modification. If all modes have zero matching items, they are classified as unknown abnormal modes. After comparison and classification, an abnormal behavior tampering mode feature set is obtained. The abnormal behavior tampering mode feature set refers to the set of abnormal behavior features that have been classified according to specific tampering modes.

[0049] Next, the normality of the electricity meter's behavior characteristics is used as the initial tampering judgment point, and this initial tampering judgment point is set as the root node. Specifically, firstly, the reference range for the electricity meter under normal operating conditions is determined based on a multi-dimensional normal behavior characteristic set. For example, the voltage should be maintained within 95% to 105% of the rated voltage, the deviation of current change from the historical load curve should not exceed 20%, the power factor should be maintained between 0.85 and 1.0, the number of cover opening events and parameter modification events should not exceed once per unit time, such as 24 hours, and the clock offset should not exceed 5 minutes. Then, the voltage, current, power factor, event records, and time records of the sample to be tested are compared item by item with the above reference range. When all behavior characteristics fall within the normal range, the electricity meter's behavior characteristics are determined to be normal; when any one or more of the behavior characteristics exceed the normal range, the electricity meter's behavior characteristics are determined to be abnormal. Thus, the normality of the electricity meter's behavior characteristics is used as the initial tampering judgment point. The initial tampering judgment point is used to make the first judgment on the samples entering the detection process, that is, to first distinguish whether the sample needs to continue to enter the tampering pattern recognition process. Finally, the initial tampering judgment point is set as the root node, so that all samples to be detected first pass through the root node to complete the normal and abnormal flow separation.

[0050] Then, based on the electricity meter tampering mode system and root node, a tampering detection tree architecture was designed. In this process, the root node serves as the starting node of the tampering detection tree architecture. When the root node is judged to be normal, a normal result is directly output; when the root node is judged to be abnormal, the next branch is entered for judgment. The first branch is divided according to the major categories of abnormality types: magnetic field interference, wiring abnormality, parameter tampering, and signal interference. Specifically, magnetic field interference corresponds to samples with magnetic field alarms or current drops exceeding 30% and voltage changes less than 5%; wiring abnormality corresponds to samples with current phase offsets greater than 15 degrees or abnormal power directions; parameter tampering corresponds to samples with parameter modifications exceeding 3 times per hour or clock offsets greater than 5 minutes; and signal interference corresponds to samples with voltage harmonic content greater than 8% or pulse counts exceeding 10 times per minute. The second-level branches further subdivide each major category: In the magnetic field interference category, it determines whether the complete criteria for strong magnetic interference are met (magnetic field alarm and current drop exceeding 30%); in the wiring abnormality category, it determines whether it involves bypass power theft (current drop exceeding 40% and power factor drop exceeding 0.2) or terminal reversal (phase offset greater than 15 degrees); in the parameter tampering category, it determines whether it involves clock tampering (clock offset greater than 5 minutes and adjustment record) or abnormal parameter modification (parameter modification count exceeding threshold); in the signal interference category, it determines whether it involves high-frequency pulse injection (harmonic content greater than 8% and pulse count exceeding threshold). Finally, each specific tampering mode is set as a tampering mode type leaf node, including strong magnetic interference leaf nodes, bypass power theft leaf nodes, high-frequency pulse injection leaf nodes, clock tampering leaf nodes, terminal reversal leaf nodes, abnormal parameter modification leaf nodes, and unknown abnormality leaf nodes. The tampering mode type leaf node is the terminal node used to output the final tampering type result. The above method forms a tamper detection tree architecture that includes a root node, multi-level branches of tampering patterns, and leaf nodes of tampering pattern types.

[0051] Finally, a cascaded judgment analysis is performed on the abnormal behavior tampering pattern feature set based on the tampering detection tree architecture. In this process, the abnormal behavior tampering pattern feature set is matched with the tampering detection tree architecture to obtain a multi-branch type matching abnormal behavior feature set. Then, the multi-branch type matching abnormal behavior feature set is used as a branch node for cascaded judgment rule mining, resulting in a branch feature node judgment rule library. Finally, based on the branch feature node judgment rule library and the tampering detection tree architecture, a cascaded judgment analysis is performed on the abnormal behavior tampering pattern feature set to build the electricity meter tampering pattern detection tree.

[0052] Furthermore, in the method provided in the application embodiments, the method further includes: performing cascaded judgment analysis on the abnormal behavior tampering pattern feature set based on the tampering detection tree architecture to build an electricity meter tampering pattern detection tree;

[0053] The abnormal behavior tampering pattern feature set is matched with the tampering detection tree architecture to obtain a multi-branch type matching abnormal behavior feature set; the multi-branch type matching abnormal behavior feature set is used as a branch node to perform cascaded judgment rule mining to obtain a branch feature node judgment rule library; according to the branch feature node judgment rule library, the abnormal behavior tampering pattern feature set is analyzed by cascaded judgment based on the tampering detection tree architecture to build an electricity meter tampering pattern detection tree.

[0054] In this embodiment, when performing branch matching between the abnormal behavior tampering pattern feature set and the tampering detection tree architecture, firstly, the constructed tampering detection tree architecture is read, including the root node, first-level branch nodes, second-level branch nodes, and leaf nodes. The first-level branch nodes are divided into magnetic field interference, wiring abnormality, parameter tampering, and signal interference categories. The second-level branch nodes include strong magnetic interference, bypass power theft, high-frequency pulse injection, clock tampering, terminal reverse connection, and abnormal parameter modification, etc. Next, each sample is extracted from the abnormal behavior tampering pattern feature set. Each sample contains a 256-dimensional feature vector and its labeled tampering pattern tag. The sample's voltage, current, power factor, clock offset, event record, and other features are compared item by item with the judgment conditions of the first-level branch nodes. If a sample meets the judgment conditions of a certain branch node, the sample is matched to that branch. For example, if the magnetic field alarm flag is 1 and the current drop is greater than 30% while the voltage change is less than 5%, the sample is matched to the magnetic field interference branch; if the current phase shift is greater than 15 degrees, it is matched to the wiring abnormality branch; if the parameter modification count is greater than 3 times per hour, it is matched to the parameter tampering branch; if the voltage harmonic content is greater than 8% and the pulse count is greater than 10 times per minute, it is matched to the signal interference branch. After completing the first-level branch matching, the sample features are further matched with the second-level branch node judgment conditions under the corresponding branch. For example, under the magnetic field interference branch, if the sample's power factor drops greater than 0.2, it is matched to the strong magnetic interference leaf node; otherwise, it is matched to other magnetic field abnormality leaf nodes. Through this process, the complete path matched by each sample is recorded, and the samples are grouped and stored according to the final matched leaf node type. Finally, a multi-branch type matching abnormal behavior feature set is obtained. This feature set is organized according to the leaf node category, and each leaf node contains the corresponding sample and its original features.

[0055] Next, the multi-branch type matching abnormal behavior feature set is used as a branch node for cascaded judgment rule mining. Specifically, for each non-leaf node in the tamper detection tree architecture, including the root node, first-level branch nodes, and second-level branch nodes, a subset of samples from the corresponding multi-branch type matching abnormal behavior feature set under that node is extracted. For each node, the value distribution of all samples under that node in each feature dimension is calculated. That is, for each feature dimension, the mean and standard deviation of samples belonging to different child node categories under that node on that feature are calculated. The feature that can best distinguish different child node categories is selected as the judgment criterion. For example, for the magnetic field interference branch node, its child nodes include strong magnetic interference leaf nodes and non-strong magnetic interference leaf nodes. The mean values ​​of these two types of samples in features such as current decrease amplitude and voltage change amplitude are calculated. If the mean current decrease amplitude of strong magnetic interference samples is 35% and the mean current decrease amplitude of non-strong magnetic interference samples is 5%, then a current decrease amplitude threshold of 20% is set as the distinction rule. For the root node, the distribution of normal and abnormal samples across various features is statistically analyzed. Conditions such as a normal voltage range of 220V ± 5%, current variation deviation not exceeding 20%, and power factor not lower than 0.85 are set as the criteria for determining the root node. For the first-level branch nodes, the feature distribution of samples under each branch is statistically analyzed, and judgment rules are set based on the statistical values ​​of the samples. For example, in the magnetic field interference branch, the average power factor decrease of strong magnetic interference samples is 0.25, while the average power factor decrease of other abnormal magnetic field samples is 0.10; a power factor decrease threshold of 0.15 is set. For the second-level branch nodes, if further refinement of rules is needed, features are further statistically analyzed and extracted. Finally, the judgment rules for each node are organized into a unified format, forming a branch feature node judgment rule library, which includes judgment rules for each non-leaf node, for subsequent branch matching and judgment.

[0056] Finally, based on the tamper detection tree architecture, the feature set of abnormal behavior tampering patterns is analyzed through cascaded judgment based on the branch feature node judgment rule base, thus constructing a tampering pattern detection tree for the electricity meter. In this process, the rules in the branch feature node judgment rule base are embedded into the corresponding nodes of the tampering detection tree architecture. By traversing each non-leaf node of the tampering detection tree architecture, the judgment rule corresponding to that node is bound to the node in the form of sequential judgment statements. The root node is bound with the judgment rule for normal and abnormal behavior as follows: if the voltage value is within ±5% of the rated voltage, the deviation of the current change from the historical load curve does not exceed 20%, the power factor is between 0.85 and 1.00, the opening event does not exceed once within 24 hours, the number of parameter modifications does not exceed once within 24 hours, and the clock offset does not exceed 5 minutes, then it is judged as normal and a normal result is output; otherwise, it is judged as abnormal and enters the abnormal branch. The first-level branch nodes are bound to their respective major category judgment rules as follows: Magnetic field interference branch nodes are bound if the magnetic field alarm flag is equal to 1 and the current drop is greater than 30% and the voltage change is less than 5%, then enter this branch; otherwise, continue to the next branch. Wiring abnormality branch nodes are bound if the current phase offset is greater than 15 degrees or the power direction is abnormal. Parameter tampering branch nodes are bound if the number of parameter modifications is greater than 3 times per hour or the clock offset is greater than 5 minutes. Signal interference branch nodes are bound if the voltage harmonic content is greater than 8% or the pulse count is greater than 10 times per minute. The second-level branch nodes are bound to specific rules for tampering modes. Under the magnetic field interference branch, if the power factor drops by more than 0.15, it is determined to be a strong magnetic interference leaf node; otherwise, it is determined to be another abnormal magnetic field leaf node. Under the wiring abnormality branch, if the current drops by more than 40% and the power factor drops by more than 0.2, it is determined to be a bypass power theft leaf node; otherwise, if the current phase shift is more than 15 degrees, it is determined to be a terminal reverse connection leaf node. Under the parameter tampering branch, if the clock offset is more than 5 minutes and there is a clock adjustment record, it is determined to be a clock tampering leaf node; otherwise, it is determined to be a parameter abnormal modification leaf node. Under the signal interference branch, if the voltage harmonic content is more than 8% and the pulse count is more than 10 times per minute, it is determined to be a high-frequency pulse injection leaf node. After rule embedding is complete, all samples in the entire abnormal behavior tampering pattern feature set are re-input into the enhanced tree structure. Judgment is performed level by level starting from the root node, applying the root node's rules. If the judgment is normal, the process terminates and the result is recorded; if the judgment is abnormal, the process jumps to the corresponding first-level branch node according to the rules, continuing to apply the rules of that branch node, and so on, until a leaf node is reached. The tampering pattern type corresponding to that leaf node is output as the final judgment result. The judgment path and output result for each sample are recorded. If a sample is found to be unable to match any rules or to match multiple conflicting rules, the sample is marked as rule-overridden, and the process returns to the second step to adjust the threshold and re-extract rules.Ultimately, a complete, well-defined, and progressively executable electricity meter tampering pattern detection tree is formed.

[0057] Furthermore, in the method provided in the application embodiments, the abnormal behavior evaluation model and the electricity meter tampering pattern detection tree are cascaded, merged, and iteratively optimized to generate an electricity meter anti-tampering detection channel, which further includes:

[0058] A preset anomaly level benchmark is established, and an activation layer of the detection tree is determined based on the benchmark. The abnormal behavior evaluation model and the electricity meter tampering mode detection tree are then connected in series and merged according to the activation layer to obtain an initial anti-tampering detection channel. The initial anti-tampering detection channel is iteratively tested and optimized to generate an electricity meter anti-tampering detection channel.

[0059] In this embodiment, when setting the anomaly level benchmark, a statistical segmentation method is used to divide the electricity meter anomaly index output by the abnormal behavior assessment model into intervals. Specifically, the abnormal behavior assessment model is called to calculate the electricity meter anomaly index for each sample in the multidimensional normal behavior feature set and the multidimensional abnormal behavior feature set. This electricity meter anomaly index is used to characterize the degree to which the sample deviates from the normal operating state, and its value range is set to 0 to 1. The distribution of the electricity meter anomaly index of normal samples and abnormal samples is statistically analyzed. For example, the electricity meter anomaly index of normal samples is concentrated between 0.00 and 0.30, and the electricity meter anomaly index of abnormal samples is concentrated between 0.30 and 1.00. Based on this, 0.00 to 0.30 is set as the low anomaly interval, 0.30 to 0.60 is set as the medium anomaly interval, 0.60 to 0.85 is set as the high anomaly interval, and 0.85 and above is set as the severe anomaly interval, thereby forming the anomaly level benchmark. Subsequently, when determining the activation layer of the detection tree based on the anomaly severity benchmark, the hierarchical structure of the electricity meter tampering mode detection tree is read. This detection tree includes a root node, first-level branch nodes, second-level branch nodes, and tampering mode type leaf nodes. The anomaly severity range is mapped to the tree hierarchy: when the electricity meter anomaly index is between 0.00 and 0.30, the activation layer is set as the root node; when the electricity meter anomaly index is above 0.30 but below 0.60, the activation layer is set as a first-level branch node; when the electricity meter anomaly index is above 0.60 but below 0.85, the activation layer is set as a second-level branch node; and when the electricity meter anomaly index is above 0.85, the activation layer is set as the path containing the tampering mode type leaf node. This completes the determination of the activation layer of the detection tree, which refers to the initial entry level of the electricity meter tampering mode detection tree triggered by the electricity meter anomaly index.

[0060] Next, when merging the abnormal behavior assessment model and the electricity meter tampering pattern detection tree in series according to the detection tree activation layer, a sequential routing method is used to obtain the initial anti-tampering detection channel. Specifically, the electricity meter's operating characteristic data is input into the abnormal behavior assessment model, which outputs the electricity meter's abnormality index and abnormality level label. The electricity meter's abnormality index is compared with the abnormality level benchmark to determine the corresponding detection tree activation layer. Then, a data transmission interface is established between the output of the abnormal behavior assessment model and the input of the electricity meter tampering pattern detection tree, synchronously transmitting the sample number, electricity meter abnormality index, abnormality level label, and original behavior feature vector to the electricity meter tampering pattern detection tree. Next, sample routing is performed according to the activation layer of the detection tree. When the activation layer is the root node, the sample is sent to the root node for normal / abnormal judgment. When the activation layer is a first-level branch node, the sample is sent to the magnetic field interference, wiring abnormality, parameter tampering, or signal interference branch. When the activation layer is a second-level branch node, the sample is sent to the subdivided node path corresponding to strong magnetic interference, bypass power theft, high-frequency pulse injection, clock tampering, terminal reverse connection, or parameter abnormal modification. When the activation layer corresponds to the leaf node of the tampering mode type, the tampering mode matching of the corresponding path is directly performed. This forms the initial anti-tampering detection channel, which is formed by connecting the abnormal behavior evaluation model and the electricity meter tampering mode detection tree in sequence.

[0061] Finally, the initial anti-tampering detection channel was iteratively tested and optimized. In this process, firstly, a simulated sample set of electricity meter tampering was generated based on the application scenario of electricity meter tampering; then, the simulated sample set was used to conduct attack simulation tests and evaluations on the initial anti-tampering detection channel to obtain its performance parameters; finally, based on the performance parameters, iterative loss optimization was performed on the initial anti-tampering detection channel to generate a new electricity meter anti-tampering detection channel.

[0062] Furthermore, in the method provided in the application embodiment, the method of iteratively testing and optimizing the initial anti-tampering detection channel to generate an anti-tampering detection channel for the electricity meter further includes:

[0063] Based on the application scenario of electricity meter tampering, a set of simulated electricity meter tampering samples is generated; the initial anti-tampering detection channel is subjected to attack simulation test and evaluation using the set of simulated electricity meter tampering samples to obtain the performance parameters of the anti-tampering detection channel; based on the performance parameters of the anti-tampering detection channel, the initial anti-tampering detection channel is iteratively optimized to generate an anti-tampering detection channel for electricity meters.

[0064] In this embodiment, a simulated sample set of electricity meter tampering is first generated based on the application scenarios of electricity meter tampering. This process first determines the application scenarios of electricity meter tampering, including residential electricity consumption scenarios, industrial load scenarios, centralized data collection scenarios in distribution substations, and remote parameter maintenance scenarios. Then, normal samples are selected as base samples from a multi-dimensional normal behavior feature set; for example, 6000 normal samples are selected, each sample being a 256-dimensional feature vector. Then, tampering features are injected into the base samples according to the tampering methods corresponding to different application scenarios: In residential electricity consumption scenarios, bypass electricity theft features are injected into the samples, causing the current drop to reach 40% to 80%, the voltage change to be less than 5%, and the power factor to drop by more than 0.2; in industrial load scenarios, strong magnetic interference features are injected, causing the magnetic field alarm flag to be set to 1, the current drop to reach 30% to 60%, and the voltage change to be less than 5%; in remote parameter maintenance scenarios, clock tampering features are injected, causing the clock offset to reach 5 to 30 minutes and adding clock adjustment records; in signal interference scenarios, high-frequency pulse injection features are injected, causing the voltage harmonic content to be greater than 8% and the pulse count to reach 10 to 30 times per minute; in wiring abnormality scenarios, terminal reverse connection features are injected, causing the current phase offset to be greater than 15 degrees; in parameter tampering scenarios, abnormal parameter modification features are injected, causing the number of parameter modifications to reach more than 3 times per hour and the change in parameter values ​​before and after modification to exceed a preset threshold. Finally, the samples with completed feature injection are numbered and stored according to tampering type and scenario label to obtain the electricity meter tampering simulation sample set. The electricity meter tampering simulation sample set refers to a set of test samples with scene identifiers, tampering type identifiers, and abnormal characteristic parameters.

[0065] Next, the initial anti-tampering detection channel was tested and evaluated using a simulated sample set of electricity meter tampering. During this process, samples from the simulated sample set were input into the initial anti-tampering detection channel in batches of 64. This channel includes an abnormal behavior evaluation model and an electricity meter tampering pattern detection tree. The output results of the electricity meter anomaly index, the activation layer selection result of the detection tree, the branch matching result of the tampering detection tree, and the final tampering pattern recognition result for each sample in the abnormal behavior evaluation model were recorded. The above output results were compared one by one with the preset tampering type labels of the samples. The number of correctly detected samples, the number of incorrectly detected samples, the number of undetected samples, and the number of false alarms were counted, and the performance parameters of the anti-tampering detection channel were calculated accordingly. The performance parameters of the anti-tampering detection channel include detection accuracy, false negative rate, false positive rate, average response time, and tampering pattern recognition accuracy. For example, in 6000 simulated samples, if 5700 are correctly identified, 120 are missed, 180 are falsely detected, and the average single-sample response time is 85 milliseconds, then the detection accuracy is 95.0%, the missed detection rate is 2.0%, the false detection rate is 3.0%, and the average response time is 85 milliseconds. Finally, the above performance parameters are summarized according to sample scenario, tampering type, and detection level to form an anti-tampering detection channel performance parameter table.

[0066] Finally, iterative loss optimization of the initial anti-tampering detection channel was performed based on its performance parameters. In this process, the performance parameter table of the anti-tampering detection channel was first read to determine the target items to be optimized. Iterative loss optimization was initiated when the detection accuracy was below 95%, the false negative rate was above 3%, the false positive rate was above 3%, or the average response time was above 100 milliseconds. Then, a loss function was constructed, where the anomaly classification error of the abnormal behavior evaluation model accounted for 0.5, the activation layer selection error of the detection tree accounted for 0.2, and the tampering pattern recognition error accounted for 0.3. The initial anti-tampering detection channel was retrained using a simulated electricity meter tampering sample set: the Adam optimizer was used to update the network parameters of the abnormal behavior evaluation model, with a learning rate of 0.0005 and a batch size of 32. After each training round, the interval threshold of the anomaly baseline and the branch decision threshold in the electricity meter tampering pattern detection tree were adjusted synchronously, with a threshold adjustment step size of 0.02 or 5%. The process of sample input, performance evaluation, and parameter update is repeated. The performance parameters of the anti-tampering detection channel are recalculated every 10 rounds of training until the detection accuracy is no less than 97%, the false negative rate is no more than 2%, the false positive rate is no more than 2%, and the average response time is no more than 90 milliseconds. Finally, the abnormal behavior evaluation model parameters, abnormality baseline parameters, and electricity meter tampering pattern detection tree judgment parameters are solidified when the preset performance requirements are met, thus generating the electricity meter anti-tampering detection channel.

[0067] Step S400: Monitor the working characteristic data of the electricity meter in real time, perform anti-tampering detection on the working characteristic data of the electricity meter based on the anti-tampering detection channel of the electricity meter, and determine the anti-tampering detection result of the electricity meter.

[0068] In this embodiment of the application, the working characteristic data of the electricity meter is first monitored in real time. That is, the original data such as voltage, current, power factor, event record, and clock status are collected in real time at a frequency of once per second through the sampling chip built into the electricity meter, and 256-dimensional behavioral features are extracted in the same way as in the training phase to form the working characteristic data of the electricity meter.

[0069] Next, anti-tampering detection is performed on the operating characteristic data of the electricity meter based on the anti-tampering detection channel. During this process, the degree of anomaly in the operating characteristic data of the electricity meter is assessed based on an abnormal behavior evaluation model, and an anomaly index of the electricity meter is output. If the anomaly index triggers the activation layer of the detection tree, the tampering mode detection tree of the electricity meter is activated to perform anti-tampering detection on the operating characteristic data of the electricity meter, thus determining the anti-tampering detection result of the electricity meter.

[0070] Furthermore, in the method provided in the application embodiments, the method of performing anti-tampering detection on the working characteristic data of the electricity meter based on the anti-tampering detection channel of the electricity meter and determining the anti-tampering detection result of the electricity meter further includes:

[0071] Based on the abnormal behavior evaluation model, the abnormality level of the working characteristic data of the electricity meter is evaluated, and the electricity meter abnormality index is output. If the electricity meter abnormality index triggers the detection tree activation layer, the electricity meter tampering mode detection tree is activated to perform anti-tampering detection on the working characteristic data of the electricity meter, and the anti-tampering detection result of the electricity meter is determined.

[0072] In this embodiment of the application, the working characteristic data of the electricity meter, which is collected in real time and obtained through feature extraction, is first input into the constructed abnormal behavior evaluation model. The model learns through a deep neural network and outputs an electricity meter abnormality index in the range of 0 to 1. The electricity meter abnormality index quantitatively characterizes the degree to which the current working characteristic data deviates from the normal operating state.

[0073] Then, it is determined whether the abnormal index of the electricity meter reaches or exceeds the abnormality level benchmark corresponding to the preset detection tree activation layer. If it is not triggered, it is directly judged as normal and the detection ends. If it is triggered, the electricity meter tampering mode detection tree is activated. Subsequently, the same set of electricity meter working characteristic data is sent to the electricity meter tampering mode detection tree. The detection tree starts from the root node or the starting node determined according to the abnormal index level, and matches layer by layer according to the cascade judgment conditions in the branch feature node judgment rule library, and finally converges to the leaf node of the corresponding tampering mode type. Finally, the specific tampering mode type output by the leaf node, such as strong magnetic interference, bypass power theft, high frequency pulse injection, clock tampering, terminal reverse connection or abnormal parameter modification, etc., is output as the electricity meter anti-tampering detection result.

[0074] In summary, the embodiments of this application have at least the following technical effects:

[0075] This application collects historical tampering datasets of electricity meters, extracts and labels behavioral features from these datasets to obtain multi-dimensional normal behavior feature sets and multi-dimensional abnormal behavior feature sets. Based on the anti-tampering requirements of electricity meters, a preset sensitivity threshold is established. An anomaly assessment model is constructed based on this threshold to evaluate the degree of abnormality in the multi-dimensional normal behavior feature sets and multi-dimensional abnormal behavior feature sets. An electricity meter tampering pattern detection tree is built, and the abnormal behavior assessment model and the electricity meter tampering pattern detection tree are cascaded, merged, and iteratively optimized to generate an electricity meter anti-tampering detection channel. The working characteristic data of the electricity meter is monitored in real time, and anti-tampering detection is performed on the working characteristic data based on the electricity meter anti-tampering detection channel to determine the electricity meter anti-tampering detection result. This invention solves the technical problem of insufficient accuracy in electricity meter tampering detection in existing technologies. By collecting historical tampering datasets and extracting and labeling multi-dimensional behavioral features, constructing an abnormal behavior assessment model and building a tampering pattern detection tree, and cascading and merging these two models iteratively optimizing them to generate an anti-tampering detection channel, the technical effect of improving the accuracy of electricity meter anti-tampering detection is achieved.

[0076] Example 2, based on the same inventive concept as the behavioral feature recognition method for tamper-proof detection of electricity meters in the foregoing examples, such as... Figure 2 As shown, this application provides a tamper-proof detection system for electricity meters based on behavioral feature recognition. The system and method embodiments in this application are based on the same inventive concept. The system includes:

[0077] The data acquisition module 11 is used to collect historical tampering datasets of the electricity meter, extract and label behavioral features from the historical tampering datasets to obtain a multi-dimensional normal behavior feature set and a multi-dimensional abnormal behavior feature set; the evaluation and modeling module 12 is used to preset a sensitivity threshold according to the anti-tampering requirements of the electricity meter, and perform anomaly degree evaluation and modeling on the multi-dimensional normal behavior feature set and the multi-dimensional abnormal behavior feature set based on the sensitivity threshold, and construct an abnormal behavior evaluation model; the channel generation module 13 is used to build an electricity meter tampering pattern detection tree, and connect, merge and iteratively optimize the abnormal behavior evaluation model and the electricity meter tampering pattern detection tree to generate an electricity meter anti-tampering detection channel; the anti-tampering detection module 14 is used to monitor the working characteristic data of the electricity meter in real time, perform anti-tampering detection on the working characteristic data of the electricity meter based on the anti-tampering detection channel, and determine the anti-tampering detection result of the electricity meter.

[0078] Furthermore, the system is also used to implement the following functions:

[0079] The historical tampering dataset of the electricity meters is cleaned and behavioral features are extracted to obtain a set of electricity meter-related behavioral features. Based on the tampering type and characteristics, electricity meter behavior labeling rules are determined. The electricity meter-related behavioral feature set is proportionally labeled and classified according to the labeling rules to construct an electricity meter behavior classifier. Based on the electricity meter behavior classifier, the labeling of the electricity meter-related behavioral feature set is corrected to obtain a multi-dimensional normal behavior feature set and a multi-dimensional abnormal behavior feature set.

[0080] Furthermore, the system is also used to implement the following functions:

[0081] A transfer learning mechanism is introduced to perform benchmark-supervised modeling of the multidimensional normal behavior feature set, generating a normal behavior baseline model; the multidimensional abnormal behavior feature set is input into the normal behavior baseline model for comparison, obtaining an abnormal behavior deviation feature set; the abnormality degree of the abnormal behavior deviation feature set is evaluated and identified based on the sensitivity threshold, obtaining an abnormal behavior feature degree sample set; a deep neural network is used to train and model the abnormality degree of the abnormal behavior feature degree sample set, constructing an abnormal behavior evaluation model.

[0082] Furthermore, the system is also used to implement the following functions:

[0083] Source domain data of electricity meter behavior is selected based on the transfer learning mechanism. Model selection and training are performed based on the characteristic information of the source domain data of electricity meter behavior to construct a source domain behavior pre-trained model. A model transfer strategy is designed, which includes feature transfer and architecture fine-tuning. The model transfer strategy is used to perform transfer training and modeling on the multidimensional normal behavior feature set based on the source domain behavior pre-trained model to obtain an initial behavior baseline model. The performance of the initial behavior baseline model is evaluated and optimized to generate a normal behavior baseline model.

[0084] Furthermore, the system is also used to implement the following functions:

[0085] A tampering pattern system for electricity meters is defined. The multi-dimensional abnormal behavior feature set is then classified according to this system to obtain an abnormal behavior tampering pattern feature set. The normality of the electricity meter's behavior features is used as the initial tampering judgment point, which is set as the root node. Based on the tampering pattern system and the root node, a tampering detection tree architecture is designed, including multi-level branches for tampering patterns and leaf nodes for tampering pattern types. A cascaded judgment analysis is performed on the abnormal behavior tampering pattern feature set based on the tampering detection tree architecture to construct the electricity meter tampering pattern detection tree.

[0086] Furthermore, the system is also used to implement the following functions:

[0087] The abnormal behavior tampering pattern feature set is matched with the tampering detection tree architecture to obtain a multi-branch type matching abnormal behavior feature set; the multi-branch type matching abnormal behavior feature set is used as a branch node to perform cascaded judgment rule mining to obtain a branch feature node judgment rule library; according to the branch feature node judgment rule library, the abnormal behavior tampering pattern feature set is analyzed by cascaded judgment based on the tampering detection tree architecture to build an electricity meter tampering pattern detection tree.

[0088] Furthermore, the system is also used to implement the following functions:

[0089] A preset anomaly level benchmark is established, and an activation layer of the detection tree is determined based on the benchmark. The abnormal behavior evaluation model and the electricity meter tampering mode detection tree are then connected in series and merged according to the activation layer to obtain an initial anti-tampering detection channel. The initial anti-tampering detection channel is iteratively tested and optimized to generate an electricity meter anti-tampering detection channel.

[0090] Furthermore, the system is also used to implement the following functions:

[0091] Based on the application scenario of electricity meter tampering, a set of simulated electricity meter tampering samples is generated; the initial anti-tampering detection channel is subjected to attack simulation test and evaluation using the set of simulated electricity meter tampering samples to obtain the performance parameters of the anti-tampering detection channel; based on the performance parameters of the anti-tampering detection channel, the initial anti-tampering detection channel is iteratively optimized to generate an anti-tampering detection channel for electricity meters.

[0092] Furthermore, the system is also used to implement the following functions:

[0093] Based on the abnormal behavior evaluation model, the abnormality level of the working characteristic data of the electricity meter is evaluated, and the electricity meter abnormality index is output. If the electricity meter abnormality index triggers the detection tree activation layer, the electricity meter tampering mode detection tree is activated to perform anti-tampering detection on the working characteristic data of the electricity meter, and the anti-tampering detection result of the electricity meter is determined.

[0094] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0095] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for tamper-proof detection of electricity meters based on behavioral feature recognition, characterized in that, The method includes: Collect a historical tampering dataset of electricity meters, extract and label behavioral features from the historical tampering dataset of electricity meters, and obtain a multi-dimensional normal behavior feature set and a multi-dimensional abnormal behavior feature set; Based on the anti-tampering requirements of electricity meters, a sensitivity threshold is preset, and an abnormality assessment model is constructed by evaluating and modeling the multidimensional normal behavior feature set and the multidimensional abnormal behavior feature set based on the sensitivity threshold. A power meter tampering mode detection tree is constructed. The abnormal behavior evaluation model and the power meter tampering mode detection tree are connected, merged, and iteratively optimized to generate a power meter anti-tampering detection channel. Real-time monitoring of the working characteristic data of the electricity meter; anti-tampering detection of the working characteristic data of the electricity meter based on the anti-tampering detection channel of the electricity meter; and determination of the anti-tampering detection result of the electricity meter. Construct an abnormal behavior assessment model, including: A transfer learning mechanism is introduced to perform benchmark-supervised modeling on the multidimensional normal behavior feature set, generating a normal behavior baseline model; The multidimensional abnormal behavior feature set is input into the normal behavior baseline model for comparison to obtain the abnormal behavior deviation feature set. Based on the sensitivity threshold, the abnormality degree of the deviation feature set of the abnormal behavior is evaluated and identified to obtain a sample set of abnormal behavior feature degree. A deep neural network is used to train and model the abnormality level of the sample set of abnormal behavior features to construct an abnormal behavior evaluation model. Construct a tampering pattern detection tree for electricity meters, including: Define an electricity meter tampering mode system, and classify the multidimensional abnormal behavior feature set according to the electricity meter tampering mode system to obtain the abnormal behavior tampering mode feature set; The initial tampering judgment point is set as whether the behavior characteristics of the electricity meter are normal, and the initial tampering judgment point is set as the root node; Based on the electricity meter tampering mode system and the root node, a tampering detection tree architecture is designed, which includes tampering mode multi-level branches and tampering mode type leaf nodes; Based on the tampering detection tree architecture, a cascaded judgment analysis is performed on the feature set of abnormal behavior tampering patterns to build an electricity meter tampering pattern detection tree.

2. The method for preventing tampering of electricity meters based on behavioral feature recognition as described in claim 1, characterized in that, Behavioral features are extracted and labeled from the historical tampering dataset of the electricity meters to obtain a multidimensional normal behavior feature set and a multidimensional abnormal behavior feature set, including: Data cleaning and behavioral feature extraction are performed on the historical tampering dataset of the electricity meters to obtain the electricity meter-related behavioral feature set; Based on the type and characteristics of electricity meter tampering, determine the rules for labeling electricity meter behavior; According to the electricity meter behavior labeling rules, the electricity meter associated behavior feature set is proportionally labeled and classified for training to construct an electricity meter behavior classifier. The electricity meter behavior classifier is used to label and correct the associated behavior feature set of the electricity meter to obtain a multidimensional normal behavior feature set and a multidimensional abnormal behavior feature set.

3. The method for preventing tampering of electricity meters based on behavioral feature recognition as described in claim 1, characterized in that, A transfer learning mechanism is introduced to perform benchmark-supervised modeling of the multidimensional normal behavior feature set, generating a normal behavior baseline model, including: The source domain data of the electricity meter behavior is selected according to the transfer learning mechanism, and the model selection and training are carried out based on the characteristic information of the source domain data of the electricity meter behavior to construct a source domain behavior pre-training model. Design a model migration strategy, which includes feature migration and architecture fine-tuning; The model transfer strategy is used to perform transfer training modeling on the multidimensional normal behavior feature set based on the source domain behavior pre-trained model to obtain an initial behavior baseline model. The initial behavioral baseline model is evaluated and optimized to generate a normal behavioral baseline model.

4. The method for preventing tampering of electricity meters based on behavioral feature recognition as described in claim 1, characterized in that, Based on the aforementioned tampering detection tree architecture, a cascaded judgment analysis is performed on the feature set of abnormal behavior tampering patterns to construct an electricity meter tampering pattern detection tree, including: The abnormal behavior tampering pattern feature set is matched with the tampering detection tree architecture to obtain a multi-branch type matching abnormal behavior feature set; The multi-branch type matching abnormal behavior feature set is used as a branch node, and cascaded judgment rule mining is performed to obtain a branch feature node judgment rule library. Based on the tampering detection tree architecture, the branch feature node judgment rule base is used to perform cascade judgment analysis on the abnormal behavior tampering pattern feature set to build an electricity meter tampering pattern detection tree.

5. The method for preventing tampering of electricity meters based on behavioral feature recognition as described in claim 1, characterized in that, The abnormal behavior evaluation model and the electricity meter tampering pattern detection tree are cascaded, merged, and iteratively optimized to generate an electricity meter anti-tampering detection channel, including: A preset anomaly level benchmark is established, and the activation layer of the detection tree is determined based on the anomaly level benchmark. The abnormal behavior evaluation model and the electricity meter tampering mode detection tree are connected and merged in series according to the detection tree activation layer to obtain the initial anti-tampering detection channel. The initial anti-tampering detection channel is iteratively tested and optimized to generate an anti-tampering detection channel for the electricity meter.

6. The method for preventing tampering of electricity meters based on behavioral feature recognition as described in claim 5, characterized in that, The initial anti-tamper detection channel is iteratively tested and optimized to generate an anti-tamper detection channel for the electricity meter, including: Based on the application scenarios of electricity meter tampering, generate a set of simulated electricity meter tampering samples; The initial anti-tampering detection channel was subjected to attack simulation tests and evaluations using the aforementioned electricity meter tampering simulation sample set, and the performance parameters of the anti-tampering detection channel were obtained. Based on the performance parameters of the tamper-proof detection channel, the initial tamper-proof detection channel is iteratively optimized to generate an tamper-proof detection channel for the electricity meter.

7. The method for preventing tampering of electricity meters based on behavioral feature recognition as described in claim 5, characterized in that, Based on the tamper-proof detection channel of the electricity meter, the working characteristic data of the electricity meter is subjected to tamper-proof detection to determine the tamper-proof detection result of the electricity meter, including: Based on the abnormal behavior assessment model, the degree of abnormality of the working characteristic data of the electricity meter is assessed, and the electricity meter abnormality index is output. If the abnormal index of the electricity meter triggers the activation layer of the detection tree, the electricity meter tampering mode detection tree is activated to perform anti-tampering detection on the working characteristic data of the electricity meter and determine the anti-tampering detection result of the electricity meter.

8. A tamper-proof detection system for electricity meters based on behavioral feature recognition, characterized in that, The system is used to execute the electricity meter anti-tampering detection method based on behavioral feature recognition as described in any one of claims 1-7, the system comprising: The data acquisition module is used to collect historical tampering datasets of electricity meters, extract and label behavioral features from the historical tampering datasets of electricity meters, and obtain multi-dimensional normal behavior feature sets and multi-dimensional abnormal behavior feature sets. The evaluation and modeling module is used to preset a sensitivity threshold based on the anti-tampering requirements of the electricity meter, and to perform anomaly degree evaluation and modeling on the multidimensional normal behavior feature set and multidimensional abnormal behavior feature set based on the sensitivity threshold, thereby constructing an abnormal behavior evaluation model. The channel generation module is used to build an electricity meter tampering mode detection tree, and to connect, merge and iteratively optimize the abnormal behavior evaluation model and the electricity meter tampering mode detection tree to generate an electricity meter anti-tampering detection channel. The anti-tampering detection module is used to monitor the working characteristic data of the electricity meter in real time, perform anti-tampering detection on the working characteristic data of the electricity meter based on the anti-tampering detection channel of the electricity meter, and determine the anti-tampering detection result of the electricity meter.

Images