Power grid time sequence data anomaly detection method and system

Abstract

The application provides a kind of power grid time series data anomaly detection method and system, comprising: based on the waveform data of current, voltage and frequency in the power grid collected to form original time series data set;Through unsupervised learning algorithm, original time series data set is enhanced and noise is suppressed to generate clean time series data set;Using anomaly detection model, the reconstruction error and prediction error corresponding to each data point in clean time series data set are calculated, the reconstruction error and prediction error corresponding to each data point are weighted and summed to obtain the error value of each data point;The error value of each data point is compared with dynamic threshold respectively to obtain abnormal mark sequence;According to abnormal mark sequence, structured anomaly report is generated and output to power grid monitoring platform;Through unsupervised learning algorithm, the characteristics of data are enhanced and noise is suppressed, the problem that the false alarm rate of anomaly detection model caused by abnormal event in power grid time series data is high is solved, and the reliability of power grid safety supervision is improved.

Description

Technical Field

[0001] This invention relates to the field of power grid system data processing technology, specifically to a method and system for detecting anomalies in power grid time-series data. Background Technology

[0002] In the context of power grid safety supervision, anomaly detection in power grid time-series data is a data-driven analysis method used to monitor the operational status of the power grid. Time-series data records continuous changes in parameters such as voltage, current, and frequency. Anomaly detection helps identify potential faults or safety threats by recognizing behaviors that deviate from normal patterns in the data sequence.

[0003] Existing anomaly detection methods for power grid time-series data suffer from the following technical challenges: In power grid safety monitoring scenarios, time-series data such as voltage and current waveforms are susceptible to electromagnetic interference or equipment aging, exhibiting high noise and dynamic variation characteristics, leading to a reduced signal-to-noise ratio. When anomaly detection models perform pattern recognition based on this data, they struggle to effectively distinguish between genuine fault signals and random noise fluctuations, thus misinterpreting transient changes caused by normal operations as abnormal events, resulting in a higher false alarm rate. For example, in transmission line monitoring, sensor vibrations caused by strong winds can generate data spikes, which the model may incorrectly identify as arc faults when they are actually environmental interference, thereby affecting the reliability of safety warnings. Summary of the Invention

[0004] To address the high false alarm rate of anomaly detection models in existing technologies due to the high noise and dynamic characteristics of power grid time-series data, this invention proposes an anomaly detection method for power grid time-series data, comprising: Based on the collected waveform data of current, voltage and frequency in the power grid, an original time series dataset is formed; The original time-series dataset is subjected to feature enhancement and noise suppression using an unsupervised learning algorithm to generate a clean time-series dataset. Using an anomaly detection model, the reconstruction error and prediction error corresponding to each data point in the clean time series dataset are calculated. The reconstruction error and prediction error corresponding to each data point are weighted and summed to obtain the error value of each data point. The error value of each data point is compared with a dynamic threshold to obtain an anomaly labeling sequence. A structured anomaly report is generated based on the anomaly marker sequence, and the structured anomaly report is output to the power grid monitoring platform.

[0005] Preferably, the process of forming the original time-series dataset based on the collected waveform data of current, voltage, and frequency in the power grid includes: Continuous waveform data of current, voltage and frequency in the power grid are obtained by voltage transformers, current transformers and frequency monitoring devices, respectively. The waveform data is processed by a data acquisition unit to generate a time series through signal conditioning and analog-to-digital conversion. The time series is then stored in a time series database to form an original time series dataset.

[0006] Preferably, the unsupervised learning algorithm includes a feature extraction network and a temporal modeling network; The step of performing feature enhancement and noise suppression on the original time-series dataset using an unsupervised learning algorithm to generate a clean time-series dataset includes: The feature extraction network uses a convolutional autoencoder to generate a compressed feature representation from the original time-series dataset. The temporal modeling network uses a memory network to model the temporal dependencies of the compressed feature representation, thereby obtaining a temporally enhanced feature representation. The time-enhanced feature representation is subjected to noise suppression to generate the clean time-series dataset.

[0007] Preferably, the feature extraction network uses a convolutional autoencoder, and the generation of compressed feature representations from the original time-series dataset by the convolutional autoencoder includes: The convolutional autoencoder extracts features of the original temporal dataset in the local space through a sliding window of the convolutional layer; The features of the time-series dataset are reduced in dimensionality through a pooling layer to generate a compressed feature representation that characterizes the essential features of the original time-series dataset.

[0008] Preferably, the memory network includes a bidirectional long short-term memory network and an attention mechanism; the bidirectional long short-term memory network is used to parse the dynamic change patterns of the compressed feature representation of the input from both forward and backward directions, so as to capture the long-term dependencies of the compressed feature representation and generate a hidden state sequence. The attention mechanism is used as input to the hidden state sequence, calculates the attention weights at different time steps in the hidden state sequence through the attention mechanism, and outputs the temporal dependency model.

[0009] Preferably, the anomaly detection model is used to calculate the reconstruction error and prediction error of each data point in the clean time series dataset compared to the historical baseline time series data. The reconstruction error and prediction error corresponding to each data point are then weighted and summed to obtain the error value for each data point, including: The anomaly detection model is used to obtain the reconstructed data sequence corresponding to the cleaning time series dataset. Based on the deviation between the value of each data point in the cleaning time series dataset and the reconstructed value of the corresponding data point in the reconstructed data sequence, the reconstruction error of each data point in the cleaning time series dataset is calculated. The regression model of the anomaly detection model is used to learn the temporal dependencies of historical normal data to obtain a prediction sequence. The prediction error of each data point in the clean time series dataset is obtained based on the absolute difference between the value of each data point in the prediction sequence and the value of each data point in the clean time series dataset. The reconstruction error and prediction error corresponding to each data point in the clean time series dataset are weighted and summed to obtain the error value of each data point. Preferably, the step of comparing the error value of each data point with a dynamic threshold to obtain an anomaly marker sequence includes: The historical error sequence is truncated by a sliding window, and the dynamic threshold of the data point corresponding to each time point is calculated using a probability distribution function. Based on each time point, it is determined whether the error value of the data point corresponding to the time point is greater than the dynamic threshold. If so, the time point is determined to be abnormal, and the time point is marked and recorded in the abnormal mark sequence.

[0010] Preferably, generating a structured anomaly report based on the anomaly marker sequence includes: The abnormal marker sequence is aggregated to obtain multiple abnormal events; the start time, end time and duration of each abnormal event are recorded, wherein each abnormal event includes multiple abnormal time points that are consecutive in time and have the same abnormal type; In the clean time series dataset, the distorted waveform segment corresponding to each abnormal event is extracted; the degree of distortion of the distorted waveform segment corresponding to each abnormal event relative to the waveform segment of historical normal data is used as the confidence score of each abnormal event. The start time, end time, duration, and confidence score of each abnormal event are encapsulated into a data object, and each data object is serialized to generate a structured anomaly report.

[0011] Preferably, outputting the structured anomaly report to the power grid monitoring platform includes: The data receiving interface of the power grid monitoring platform is invoked, and the structured anomaly report is transmitted to the power grid monitoring platform in an asynchronous manner through the data receiving interface; the power grid monitoring platform performs deserialization parsing of the structured anomaly report and triggers an anomaly alarm.

[0012] Furthermore, this application also provides a power grid time-series data anomaly detection system, comprising: The data acquisition module generates a raw time-series dataset based on the waveform data of current, voltage, and frequency in the power grid that has been acquired. The preprocessing module performs feature enhancement and noise suppression on the original time-series dataset using an unsupervised learning algorithm to generate a clean time-series dataset. The anomaly detection module uses an anomaly detection model to calculate the reconstruction error and prediction error of each data point in the clean time series dataset compared with the historical baseline data. It then performs a weighted sum of the reconstruction error and prediction error corresponding to each data point to obtain the error value of each data point. Finally, it compares the error value of each data point with a dynamic threshold to obtain an anomaly label sequence. The report generation module generates a structured anomaly report based on the anomaly marker sequence and outputs the structured anomaly report to the power grid monitoring platform.

[0013] Preferably, the process of forming the original time-series dataset based on the collected waveform data of current, voltage, and frequency in the power grid includes: Continuous waveform data of current, voltage and frequency in the power grid are obtained by voltage transformers, current transformers and frequency monitoring devices, respectively. The waveform data is processed by a data acquisition unit to generate a time series through signal conditioning and analog-to-digital conversion. The time series is then stored in a time series database to form an original time series dataset.

[0014] Preferably, the unsupervised learning algorithm includes a feature extraction network and a temporal modeling network; The step of performing feature enhancement and noise suppression on the original time-series dataset using an unsupervised learning algorithm to generate a clean time-series dataset includes: The feature extraction network uses a convolutional autoencoder to generate a compressed feature representation from the original time-series dataset. The temporal modeling network uses a memory network to model the temporal dependencies of the compressed feature representation, thereby obtaining a temporally enhanced feature representation. The time-enhanced feature representation is subjected to noise suppression to generate the clean time-series dataset.

[0015] Preferably, the feature extraction network uses a convolutional autoencoder, and the generation of compressed feature representations from the original time-series dataset by the convolutional autoencoder includes: The convolutional autoencoder extracts features of the original temporal dataset in the local space through a sliding window of the convolutional layer; The features of the time-series dataset are reduced in dimensionality through a pooling layer to generate a compressed feature representation that characterizes the essential features of the original time-series dataset.

[0016] Preferably, the memory network includes: a bidirectional long short-term memory network and an attention mechanism; The bidirectional long short-term memory network is used to parse the dynamic changes of the compressed feature representation of the input from both the forward and backward directions, in order to capture the long-term dependencies of the compressed feature representation and generate a sequence of hidden states. The attention mechanism is used as input to the hidden state sequence, calculates the attention weights at different time steps in the hidden state sequence through the attention mechanism, and outputs the temporal dependency model.

[0017] Preferably, the anomaly detection model is used to calculate the reconstruction error and prediction error of each data point in the clean time series dataset compared to the historical baseline time series data. The reconstruction error and prediction error corresponding to each data point are then weighted and summed to obtain the error value for each data point, including: The anomaly detection model is used to obtain the reconstructed data sequence corresponding to the cleaning time series dataset. Based on the deviation between the value of each data point in the cleaning time series dataset and the reconstructed value of the corresponding data point in the reconstructed data sequence, the reconstruction error of each data point in the cleaning time series dataset is calculated. The regression model of the anomaly detection model is used to learn the temporal dependencies of historical normal data to obtain a prediction sequence. The prediction error of each data point in the clean time series dataset is obtained based on the absolute difference between the value of each data point in the prediction sequence and the value of each data point in the clean time series dataset. The reconstruction error and prediction error corresponding to each data point in the clean time series dataset are weighted and summed to obtain the error value of each data point. Preferably, the step of comparing the error value of each data point with a dynamic threshold to obtain an anomaly marker sequence includes: The historical error sequence is truncated by a sliding window, and the dynamic threshold of the data point corresponding to each time point is calculated using a probability distribution function. Based on each time point, it is determined whether the error value of the data point corresponding to the time point is greater than the dynamic threshold. If so, the time point is determined to be abnormal, and the time point is marked and recorded in the abnormal mark sequence.

[0018] Preferably, generating a structured anomaly report based on the anomaly marker sequence includes: The abnormal marker sequence is aggregated to obtain multiple abnormal events; the start time, end time and duration of each abnormal event are recorded, wherein each abnormal event includes multiple abnormal time points that are consecutive in time and have the same abnormal type; In the clean time series dataset, the distorted waveform segment corresponding to each abnormal event is extracted; the degree of distortion of the distorted waveform segment corresponding to each abnormal event relative to the waveform segment of historical normal data is used as the confidence score of each abnormal event. The start time, end time, duration, and confidence score of each abnormal event are encapsulated into a data object, and each data object is serialized to generate a structured anomaly report.

[0019] Preferably, outputting the structured anomaly report to the power grid monitoring platform includes: The system invokes the data receiving interface of the power grid monitoring platform to transmit the structured anomaly report to the platform asynchronously. The power grid monitoring platform then performs deserialization parsing on the structured anomaly report and triggers an anomaly alarm. Furthermore, the present invention also provides a computing device, including one or more processors. A processor is used to execute one or more programs; When the one or more programs are executed by the one or more processors, a power grid timing data anomaly detection method as described above is implemented.

[0020] In another aspect, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the above-described method for detecting anomalies in power grid timing data.

[0021] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention provides a method for detecting anomalies in power grid time-series data, characterized by comprising: forming an original time-series dataset based on collected waveform data of current, voltage, and frequency in the power grid; performing feature enhancement and noise suppression on the original time-series dataset using an unsupervised learning algorithm to generate a clean time-series dataset; calculating the reconstruction error and prediction error corresponding to each data point in the clean time-series dataset using an anomaly detection model, and weighting and summing the reconstruction error and prediction error corresponding to each data point to obtain the error value of each data point; comparing the error value of each data point with a dynamic threshold to obtain an anomaly label sequence; generating a structured anomaly report based on the anomaly label sequence, and outputting the structured anomaly report to the power grid monitoring platform. Unsupervised learning algorithms are used to preprocess power grid time-series data, effectively suppressing high-frequency noise and enhancing feature representation, thereby reducing signal-to-noise interference in the time-series data. In the anomaly detection stage, the anomaly detection model performs dual evaluation of reconstruction error and prediction error. This dual evaluation mechanism is combined with dynamic threshold adaptive adjustment. The dynamic threshold is optimized in real time based on kernel density estimation, accurately distinguishing between real faults and random fluctuations, and significantly reducing the false alarm rate. In the result processing stage, the generated structured anomaly report is output to the power grid monitoring platform to improve alarm accuracy and response efficiency. The anomaly detection model can adapt to changes in the power grid environment, forming a closed-loop processing system from data acquisition to decision optimization, ultimately achieving highly reliable anomaly detection in power grid safety supervision scenarios. Attached Figure Description

[0022] Figure 1 This is a flowchart of a method for detecting anomalies in power grid time-series data according to the present invention; Figure 2 This is a flowchart of a power grid timing data anomaly detection system according to the present invention; Figure 3 This is a schematic diagram of a computer device according to the present invention. Detailed Implementation

[0023] Example 1: This invention provides a method for detecting anomalies in power grid time-series data, such as... Figure 1 As shown, it includes: S1: Based on the collected waveform data of current, voltage and frequency in the power grid, a raw time series dataset is formed; S2: The original time-series dataset is enhanced with features and suppressed with noise using an unsupervised learning algorithm to generate a clean time-series dataset; S3: Using an anomaly detection model, calculate the reconstruction error and prediction error corresponding to each data point in the clean time series dataset. Sum the reconstruction error and prediction error corresponding to each data point with weights to obtain the error value of each data point. Compare the error value of each data point with a dynamic threshold to obtain an anomaly labeling sequence. S4: Generate a structured anomaly report based on the anomaly marker sequence, and output the structured anomaly report to the power grid monitoring platform.

[0024] The collected time-series data is used to provide a data foundation for subsequent preprocessing steps, ensuring the originality and integrity of the data.

[0025] The time-series dataset is used to directly reflect the operating status of the power grid.

[0026] The original time-series dataset is preprocessed using an unsupervised learning algorithm to enhance features and suppress noise, thereby generating clean time-series data. The unsupervised learning algorithm jointly optimizes feature extraction and time-series dependency modeling. The preprocessing step effectively removes data noise, enhances feature representation, and provides high-quality input for the anomaly detection step.

[0027] The generated cleaning time series data is input into the anomaly detection model. The reconstruction error and prediction error of each data point in the cleaning time series data are calculated, and the weighted sum of the reconstruction error and prediction error of each data point is used to obtain the error value of each data point. The error value is compared with a dynamic threshold. When the error value exceeds the dynamic threshold, an abnormal event is marked to obtain an anomaly marking sequence. The anomaly detection model can automatically identify abnormal events, and the dynamic threshold mechanism adapts to data changes and reduces the false alarm rate.

[0028] A structured anomaly report is generated based on the obtained anomaly marker sequence, and the structured anomaly report is output to the power grid monitoring platform.

[0029] The abnormal marker sequence is subjected to structured processing and efficient transmission of abnormal information, supporting real-time decision-making by the power grid monitoring platform.

[0030] Preferably, the process of forming the original time-series dataset based on the collected waveform data of current, voltage, and frequency in the power grid includes: Continuous waveform data of current, voltage and frequency in the power grid are obtained by voltage transformers, current transformers and frequency monitoring devices, respectively. The waveform data is processed by a data acquisition unit to generate a time series through signal conditioning and analog-to-digital conversion. The time series is then stored in a time series database to form an original time series dataset.

[0031] The time-series data is continuously acquired at a high sampling rate using voltage transformers, current transformers, and frequency monitoring devices to obtain waveform data of voltage, current, and frequency. The analog signals are then conditioned and converted from analog to digital by a data acquisition unit to generate digital time-series sequences from the waveform data. These digital time-series sequences are then stored in a time-series database to form the original time-series dataset.

[0032] Preferably, the unsupervised learning algorithm includes a feature extraction network and a temporal modeling network; The step of performing feature enhancement and noise suppression on the original time-series dataset using an unsupervised learning algorithm to generate a clean time-series dataset includes: The feature extraction network uses a convolutional autoencoder to generate a compressed feature representation from the original time-series dataset. The temporal modeling network uses a memory network to model the temporal dependencies of the compressed feature representation, thereby obtaining a temporally enhanced feature representation. The time-enhanced feature representation is subjected to noise suppression to generate the clean time-series dataset.

[0033] The unsupervised learning algorithm is based on a joint architecture of memory network and convolutional autoencoder. It can extract frequency domain features of key temporal patterns from the original time series dataset for feature enhancement, remove impulse noise by minimizing reconstruction error for noise suppression, and finally generate a clean time series dataset.

[0034] The original time-series dataset is processed by a convolutional autoencoder. Local spatial features are extracted through a sliding window of a convolutional layer and dimensionality is reduced by a pooling layer to generate a compressed feature representation. The compressed feature representation is processed using a memory network to extract the most advantageous and discriminative features for time series modeling, while suppressing noise that interferes with time series prediction, thereby achieving time series enhancement.

[0035] The memory network includes a bidirectional long short-term memory network and an attention mechanism. The bidirectional long short-term memory network parses time series from both forward and backward directions to capture long-term dependencies, and the attention mechanism weights key time steps to enhance temporal modeling. The convolutional autoencoder and the memory network are trained together, and the reconstruction error and prediction error are optimized through a composite objective function.

[0036] Preferably, the feature extraction network uses a convolutional autoencoder, and the generation of compressed feature representations from the original time-series dataset by the convolutional autoencoder includes: The convolutional autoencoder extracts features of the original temporal dataset in the local space through a sliding window of the convolutional layer; The features of the time-series dataset are reduced in dimensionality through a pooling layer to generate a compressed feature representation that characterizes the essential features of the original time-series dataset.

[0037] The convolutional autoencoder obtains the temporal key patterns of historical normal data after unsupervised learning. The convolutional autoencoder is trained by minimizing the mean square error between the input data and the reconstructed data. The pooling layer is used to reduce the feature dimension and retain the main information, thereby reducing noise interference.

[0038] The reconstruction error is calculated from the difference between the input and output of the convolutional autoencoder.

[0039] During training, the convolutional autoencoder learns to ignore or suppress irregular, random noise in the data while capturing stable, recurring, and effective features, thereby achieving noise suppression and preliminary feature purification. It then refines and condenses the original data, removing redundancy and noise, thus achieving feature enhancement compared to the original data.

[0040] Preferably, the memory network includes: a bidirectional long short-term memory network and an attention mechanism; The bidirectional long short-term memory network is used to parse the dynamic changes of the compressed feature representation of the input from both the forward and backward directions, in order to capture the long-term dependencies of the compressed feature representation and generate a sequence of hidden states. The attention mechanism is used as input to the hidden state sequence, calculates the attention weights at different time steps in the hidden state sequence through the attention mechanism, and outputs the temporal dependency model.

[0041] The bidirectional long short-term memory network learns the dynamic changes of time series in both the forward and reverse time directions, and merges the hidden states in the two directions to improve the ability to model long-term dependencies.

[0042] The attention mechanism calculates the importance weights of each time step and assigns higher weights to features at key time steps, thereby optimizing the representation capability of temporal features.

[0043] The memory network calculates the prediction error by comparing the predicted and actual values ​​of the time series.

[0044] The bidirectional long short-term memory network, through forward and backward learning, can more accurately capture the contextual information of the sequence and understand the temporal evolution of features. The attention mechanism further weights key time steps, thereby enhancing the temporal representation capability of features.

[0045] Preferably, the anomaly detection model is used to calculate the reconstruction error and prediction error of each data point in the clean time series dataset compared to the historical baseline time series data. The reconstruction error and prediction error corresponding to each data point are then weighted and summed to obtain the error value for each data point, including: The anomaly detection model is used to obtain the reconstructed data sequence corresponding to the cleaning time series dataset. Based on the deviation between the value of each data point in the cleaning time series dataset and the reconstructed value of the corresponding data point in the reconstructed data sequence, the reconstruction error of each data point in the cleaning time series dataset is calculated. The regression model of the anomaly detection model is used to learn the temporal dependencies of historical normal data to obtain a prediction sequence. The prediction error of each data point in the clean time series dataset is obtained based on the absolute difference between the value of each data point in the prediction sequence and the value of each data point in the clean time series dataset. The reconstruction error and prediction error corresponding to each data point in the clean time series dataset are weighted and summed to obtain the error value of each data point.

[0046] The reconstruction error is the error value between the current data point to be detected and the corresponding reconstructed value under the reference mode, reflecting the deviation between the current data and the reference mode; The prediction error is the absolute difference between the value of the current data point to be detected predicted by the regression model based on data from multiple previous time points and the actual value. It evaluates the difference between the output of the autoregressive model and the actual value. The number of time points is the same as the order of the autoregressive model. The autoregressive model is trained by the temporal dependencies of historical normal data.

[0047] Regression models use historical data points to predict future values, generating prediction sequences. The reconstruction error term, the maximum mean difference regularization term, and the prediction error term constitute a composite objective function, which enables end-to-end training. The autoregressive model improves the accuracy of time series prediction, and the composite objective function balances the contributions of different error terms.

[0048] The weighted sum is the sum of the weights of the reconstruction error and the prediction error. Combining the reconstruction error and the prediction error constitutes a multi-error fusion judgment. Anomalies are comprehensively evaluated through the weighted sum and through multiple error indicators, thereby improving the robustness of detection.

[0049] Preferably, the step of comparing the error value of each data point with a dynamic threshold to obtain an anomaly marker sequence includes: The historical error sequence is truncated by a sliding window, and the dynamic threshold of the data point corresponding to each time point is calculated using a probability distribution function. Based on each time point, it is determined whether the error value of the data point corresponding to the time point is greater than the dynamic threshold. If so, the time point is determined to be abnormal, and the time point is marked and recorded in the abnormal mark sequence.

[0050] The dynamic threshold extracts a historical error sequence through a sliding window, and the historical error sequence includes a predetermined number of historical reconstruction errors and historical prediction errors. Kernel density estimation is performed on the historical error sequence to fit the probability distribution function, and a predetermined quantile is extracted from the probability distribution function for adaptive adjustment. Based on the historical error sequence within the sliding window, the quantile is extracted as a dynamic threshold by fitting the probability distribution through kernel density estimation, thereby adapting to changes in the data and reducing false alarms.

[0051] Once new data points have been processed, the error sequence within the sliding window is updated, and kernel density estimation is re-executed to iteratively update the dynamic threshold. This dynamic threshold mechanism adapts to data changes, reducing the risk of false alarms.

[0052] Preferably, generating a structured anomaly report based on the anomaly marker sequence includes: The abnormal marker sequence is aggregated to obtain multiple abnormal events; the start time, end time and duration of each abnormal event are recorded, wherein each abnormal event includes multiple abnormal time points that are consecutive in time and have the same abnormal type; In the clean time series dataset, the distorted waveform segment corresponding to each abnormal event is extracted; the degree of distortion of the distorted waveform segment corresponding to each abnormal event relative to the waveform segment of historical normal data is used as the confidence score of each abnormal event. The start time, end time, duration, and confidence score of each abnormal event are encapsulated into a data object, and each data object is serialized to generate a structured anomaly report.

[0053] Event aggregation is performed on the abnormal marker sequence, and markers that are temporally continuous and have the same abnormal type are merged into a single abnormal event. Marker points with an interval of less than a preset threshold between adjacent abnormal marker points are temporally continuous marker points, and markers with the same abnormal marker value are markers with the same abnormal type.

[0054] The waveform segment of the single abnormal event is extracted from the cleaning time series data, and the degree of distortion of the waveform segment is calculated. The waveform distortion calculation includes: total harmonic distortion, peak deviation, and frequency offset. The calculated waveform distortion degree is used as a confidence score.

[0055] The single abnormal event is encapsulated into a data object, and the data object is serialized to generate an abnormal report file; the data object includes: the start timestamp of the abnormal event, the end timestamp, the duration, the types of parameters involved, and the waveform distortion degree value.

[0056] Data objects are serialized to generate standardized anomaly report files. Event aggregation and confidence scoring enhance the readability and usability of the reports.

[0057] Preferably, outputting the structured anomaly report to the power grid monitoring platform includes: The data receiving interface of the power grid monitoring platform is invoked, and the structured anomaly report is transmitted to the power grid monitoring platform in an asynchronous manner through the data receiving interface; the power grid monitoring platform performs deserialization parsing of the structured anomaly report and triggers an anomaly alarm.

[0058] The report output is sent asynchronously by calling the application programming interface function of the power grid monitoring platform. The power grid monitoring platform deserializes the abnormal report file at the receiving end, parses out the data object, stores it in the event database, and triggers the message queue notification alarm service. The alarm service matches the confidence score and abnormality type with predefined alarm rules and pushes hierarchical alarm information to the designated terminal, completing the structured processing and efficient transmission of abnormal information, and supporting the real-time decision-making of the power grid monitoring platform.

[0059] The power grid monitoring platform records anomaly marker sequences and corresponding power grid operation status data to construct a feedback dataset. Historical anomaly events and their final handling conclusions are periodically extracted from the event database and labeled to annotate the feedback dataset. The labeled feedback dataset is used to incrementally learn the anomaly detection model and optimize the weight parameters in the composite objective function to reduce false alarms for similar power grid environmental disturbances.

[0060] The incremental learning mechanism continuously optimizes model performance through feedback loops.

[0061] Example 2: Based on the same inventive concept, this invention also provides a power grid time-series data anomaly detection system, such as... Figure 2 As shown, it includes: The data acquisition module generates a raw time-series dataset based on the waveform data of current, voltage, and frequency in the power grid that has been acquired. The preprocessing module performs feature enhancement and noise suppression on the original time-series dataset using an unsupervised learning algorithm to generate a clean time-series dataset. The anomaly detection module uses an anomaly detection model to calculate the reconstruction error and prediction error of each data point in the clean time series dataset compared with the historical baseline data. It then performs a weighted sum of the reconstruction error and prediction error corresponding to each data point to obtain the error value of each data point. Finally, it compares the error value of each data point with a dynamic threshold to obtain an anomaly label sequence. The report generation module generates a structured anomaly report based on the anomaly marker sequence and outputs the structured anomaly report to the power grid monitoring platform.

[0062] Preferably, the data acquisition module includes: Continuous waveform data of current, voltage and frequency in the power grid are obtained by voltage transformers, current transformers and frequency monitoring devices, respectively. The waveform data is processed by a data acquisition unit to generate a time series through signal conditioning and analog-to-digital conversion. The time series is then stored in a time series database to form an original time series dataset.

[0063] Preferably, the processing module includes: The unsupervised learning algorithm includes a feature extraction network and a temporal modeling network; The step of performing feature enhancement and noise suppression on the original time-series dataset using an unsupervised learning algorithm to generate a clean time-series dataset includes: The feature extraction network uses a convolutional autoencoder to generate a compressed feature representation from the original time-series dataset. The temporal modeling network uses a memory network to model the temporal dependencies of the compressed feature representation, thereby obtaining a temporally enhanced feature representation. The time-enhanced feature representation is subjected to noise suppression to generate the clean time-series dataset.

[0064] Preferably, the feature extraction network uses a convolutional autoencoder to generate a compressed feature representation from the original time-series dataset, including: The convolutional autoencoder extracts features of the original temporal dataset in the local space through a sliding window of the convolutional layer; The features of the time-series dataset are reduced in dimensionality through a pooling layer to generate a compressed feature representation that characterizes the essential features of the original time-series dataset.

[0065] Preferably, the memory network includes: a bidirectional long short-term memory network and an attention mechanism; The bidirectional long short-term memory network is used to parse the dynamic changes of the compressed feature representation of the input from both the forward and backward directions, in order to capture the long-term dependencies of the compressed feature representation and generate a sequence of hidden states. The attention mechanism is used as input to the hidden state sequence, calculates the attention weights at different time steps in the hidden state sequence through the attention mechanism, and outputs the temporal dependency model.

[0066] Preferably, the anomaly detection module is specifically used for: The anomaly detection model is used to obtain the reconstructed data sequence corresponding to the cleaning time series dataset. Based on the deviation between the value of each data point in the cleaning time series dataset and the reconstructed value of the corresponding data point in the reconstructed data sequence, the reconstruction error of each data point in the cleaning time series dataset is calculated. The regression model of the anomaly detection model is used to learn the temporal dependencies of historical normal data to obtain a prediction sequence. The prediction error of each data point in the clean time series dataset is obtained based on the absolute difference between the value of each data point in the prediction sequence and the value of each data point in the clean time series dataset. The reconstruction error and prediction error corresponding to each data point in the clean time series dataset are weighted and summed to obtain the error value of each data point. Preferably, the anomaly detection module is specifically used for: The historical error sequence is truncated by a sliding window, and the dynamic threshold of the data point corresponding to each time point is calculated using a probability distribution function. Based on each time point, it is determined whether the error value of the data point corresponding to the time point is greater than the dynamic threshold. If so, the time point is determined to be abnormal, and the time point is marked and recorded in the abnormal mark sequence.

[0067] Preferably, the report generation module is specifically used for: The abnormal marker sequence is aggregated to obtain multiple abnormal events; the start time, end time and duration of each abnormal event are recorded, wherein each abnormal event includes multiple abnormal time points that are consecutive in time and have the same abnormal type; In the clean time series dataset, the distorted waveform segment corresponding to each abnormal event is extracted; the degree of distortion of the distorted waveform segment corresponding to each abnormal event relative to the waveform segment of historical normal data is used as the confidence score of each abnormal event. The start time, end time, duration, and confidence score of each abnormal event are encapsulated into a data object, and each data object is serialized to generate a structured anomaly report.

[0068] Preferably, the report generation module is further used for: The data receiving interface of the power grid monitoring platform is invoked, and the structured anomaly report is transmitted to the power grid monitoring platform asynchronously through the data receiving interface; The power grid monitoring platform is used to deserialize and parse the structured anomaly report and trigger anomaly alarms.

[0069] The high false alarm rate caused by high noise and dynamic changes in power grid time-series data is systematically addressed through multi-level technical means.

[0070] In the data preprocessing stage, an unsupervised learning algorithm combining convolutional autoencoders and memory networks is employed. The convolutional autoencoder extracts local spatial features through a sliding window in the convolutional layers, and pooling layers perform dimensionality reduction to generate compressed feature representations, effectively suppressing high-frequency noise interference. The bidirectional long short-term memory network in the memory network parses the time series from both forward and backward directions, and an attention mechanism weights key time steps to jointly capture long-term dependencies, enhancing the ability to model dynamic changes. This joint training method simultaneously optimizes reconstruction and prediction errors through a composite objective function, achieving feature enhancement and temporal dependency modeling for noisy data.

[0071] In the anomaly detection phase, detection accuracy is improved through a dual evaluation mechanism of reconstruction error and prediction error.

[0072] Reconstruction error reflects the difference between the data and the learned normal pattern, while prediction error assesses the deviation between the autoregressive model output and the actual value. The weighted sum judgment mechanism avoids the limitations of a single error index. The dynamic threshold adaptive adjustment mechanism extracts historical error sequences through a sliding window, uses kernel density estimation to fit the probability distribution function, and extracts quantiles from the distribution function as the threshold. This enables real-time updates of the threshold as the data distribution changes, effectively distinguishing between real fault signals and random fluctuations.

[0073] In the results processing stage, the event aggregation algorithm merges time-continuous markers with the same anomaly type into a single anomaly event. Combined with a confidence score calculated based on waveform distortion, it filters out false alarms caused by transient interference. Standardized anomaly reports, through structured data encapsulation and serialized transmission, ensure information integrity while improving processing efficiency. A feedback optimization mechanism constructs a closed-loop learning system. The power grid monitoring platform records anomaly marker sequences and power grid operating status data, periodically extracts historical event processing conclusions to label the feedback dataset, and optimizes the weight parameters of the composite objective function through incremental learning, enabling the model to continuously adapt to changes in the power grid environment. The entire technical solution forms a complete technical chain from data preprocessing and anomaly detection to result optimization, significantly improving the accuracy and reliability of anomaly detection through algorithmic synergy.

[0074] Example 3: Based on the same inventive concept, the present invention also provides a computer device, such as... Figure 3As shown, the computer device includes a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, and is suitable for implementing one or more instructions. Specifically, it is suitable for loading and executing one or more instructions in the computer storage medium to implement the corresponding method flow or corresponding function, so as to implement the steps of the power grid timing data anomaly detection method in the above embodiment.

[0075] Example 4: Based on the same inventive concept, this invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the steps of the power grid timing data anomaly detection method in the above embodiments.

[0076] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0077] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0078] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0079] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0080] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of the claims of the present invention pending approval.

Claims

1. A method for detecting anomalies in power grid time-series data, characterized in that, include: Based on the collected waveform data of current, voltage and frequency in the power grid, an original time series dataset is formed; The original time-series dataset is enhanced with features and suppressed with noise using an unsupervised learning algorithm to generate a clean time-series dataset. Using an anomaly detection model, the reconstruction error and prediction error corresponding to each data point in the clean time series dataset are calculated. The reconstruction error and prediction error corresponding to each data point are weighted and summed to obtain the error value of each data point. The error value of each data point is compared with a dynamic threshold to obtain an anomaly labeling sequence. A structured anomaly report is generated based on the anomaly marker sequence, and the structured anomaly report is output to the power grid monitoring platform.

2. The method as described in claim 1, characterized in that, The original time-series dataset, formed based on the collected waveform data of current, voltage, and frequency in the power grid, includes: Continuous waveform data of current, voltage and frequency in the power grid are obtained by voltage transformers, current transformers and frequency monitoring devices, respectively. The waveform data is processed by a data acquisition unit to generate a time series through signal conditioning and analog-to-digital conversion. The time series is then stored in a time series database to form an original time series dataset.

3. The method as described in claim 1, characterized in that, The unsupervised learning algorithm includes a feature extraction network and a temporal modeling network; The step of performing feature enhancement and noise suppression on the original time-series dataset using an unsupervised learning algorithm to generate a clean time-series dataset includes: The feature extraction network uses a convolutional autoencoder to generate a compressed feature representation from the original time-series dataset. The temporal modeling network uses a memory network to model the temporal dependencies of the compressed feature representation, thereby obtaining a temporally enhanced feature representation. The time-enhanced feature representation is subjected to noise suppression to generate the clean time-series dataset.

4. The method as described in claim 3, characterized in that, The feature extraction network uses a convolutional autoencoder to generate a compressed feature representation from the original time-series dataset, including: The convolutional autoencoder extracts features of the original temporal dataset in the local space through a sliding window of the convolutional layer; The features of the time-series dataset are reduced in dimensionality through a pooling layer to generate a compressed feature representation that characterizes the essential features of the original time-series dataset.

5. The method as described in claim 3, characterized in that, The memory network includes: a bidirectional long short-term memory network and an attention mechanism; The bidirectional long short-term memory network is used to parse the dynamic changes of the compressed feature representation of the input from both the forward and backward directions, in order to capture the long-term dependencies of the compressed feature representation and generate a sequence of hidden states. The attention mechanism is used as input to the hidden state sequence, calculates the attention weights at different time steps in the hidden state sequence through the attention mechanism, and outputs the temporal dependency model.

6. The method as described in claim 1, characterized in that, The anomaly detection model is used to calculate the reconstruction error and prediction error of each data point in the clean time series dataset compared to the historical baseline time series data. The reconstruction error and prediction error corresponding to each data point are weighted and summed to obtain the error value of each data point, including: The anomaly detection model is used to obtain the reconstructed data sequence corresponding to the cleaning time series dataset. Based on the deviation between the value of each data point in the cleaning time series dataset and the reconstructed value of the corresponding data point in the reconstructed data sequence, the reconstruction error of each data point in the cleaning time series dataset is calculated. The regression model of the anomaly detection model is used to learn the temporal dependencies of historical normal data to obtain a prediction sequence. The prediction error of each data point in the clean time series dataset is obtained based on the absolute difference between the value of each data point in the prediction sequence and the value of each data point in the clean time series dataset. The reconstruction error and prediction error corresponding to each data point in the clean time series dataset are weighted and summed to obtain the error value of each data point.

7. The method as described in claim 1, characterized in that, The step of comparing the error value of each data point with a dynamic threshold to obtain an anomaly marker sequence includes: The historical error sequence is truncated by a sliding window, and the dynamic threshold of the data point corresponding to each time point is calculated using a probability distribution function. Based on each time point, it is determined whether the error value of the data point corresponding to the time point is greater than the dynamic threshold. If so, the time point is determined to be abnormal, and the time point is marked and recorded in the abnormal mark sequence.

8. The method as described in claim 1, characterized in that, The step of generating a structured anomaly report based on the anomaly marker sequence includes: The abnormal marker sequence is aggregated to obtain multiple abnormal events; the start time, end time and duration of each abnormal event are recorded, wherein each abnormal event includes multiple abnormal time points that are consecutive in time and have the same abnormal type; In the clean time series dataset, the distorted waveform segment corresponding to each abnormal event is extracted; the degree of distortion of the distorted waveform segment corresponding to each abnormal event relative to the waveform segment of historical normal data is used as the confidence score of each abnormal event. The start time, end time, duration, and confidence score of each abnormal event are encapsulated into a data object, and each data object is serialized to generate a structured anomaly report.

9. The method as described in claim 1, characterized in that, The step of outputting the structured anomaly report to the power grid monitoring platform includes: The data receiving interface of the power grid monitoring platform is invoked, and the structured anomaly report is transmitted to the power grid monitoring platform in an asynchronous manner through the data receiving interface; the power grid monitoring platform performs deserialization parsing of the structured anomaly report and triggers an anomaly alarm.

10. A power grid time-series data anomaly detection system, characterized in that, include: The data acquisition module generates a raw time-series dataset based on the acquired waveform data of current, voltage, and frequency in the power grid. The preprocessing module performs feature enhancement and noise suppression on the original time-series dataset using an unsupervised learning algorithm to generate a clean time-series dataset. The anomaly detection module uses an anomaly detection model to calculate the reconstruction error and prediction error of each data point in the clean time series dataset compared with the historical baseline data. It then performs a weighted sum of the reconstruction error and prediction error corresponding to each data point to obtain the error value of each data point. Finally, it compares the error value of each data point with a dynamic threshold to obtain an anomaly label sequence. The report generation module generates a structured anomaly report based on the anomaly marker sequence and outputs the structured anomaly report to the power grid monitoring platform.

Images