Machine learning-based measurement and control device two-remote information verification method

Abstract

The embodiment of the application provides a kind of based on machine learning's measuring and controlling device two remote information verification method, belong to substation equipment test technical field.The measuring and controlling device two remote information verification method includes: the SCD file of multiple types measuring and controlling device is collected, and data information is simultaneously collected;The data extraction of SCD file and data information collected is carried out to obtain structured feature matrix;The structured feature matrix is input into isolated forest model to obtain corresponding abnormal score;The structured feature matrix and corresponding abnormal score of the abnormal score greater than preset threshold are regarded as additional features and are sent into XGBoost model to obtain corresponding abnormal category;The structured feature matrix corresponding to the abnormal category is sent into category traceability model to obtain the abnormal root source in structured feature matrix.The measuring and controlling device two remote information verification method can complete automatic pre-checking, to avoid passive verification in debugging acceptance link, shorten two remote information checking time.

Description

Technical Field

[0001] This invention relates to the field of substation equipment testing technology, and specifically to a machine learning-based method for verifying remote information of measurement and control devices. Background Technology

[0002] In the construction and operation of smart substations, the verification of telemetry and remote control signals (referred to as "telemetry and remote control information") of the monitoring and control devices is a key link in ensuring the safe operation of the power grid. Currently, the verification of telemetry and remote control information mainly relies on manual verification during the commissioning and acceptance phases. Technicians need to check the consistency between the device configuration files and the actual signal circuits one by one, which is not only time-consuming and labor-intensive, but also prone to misjudgment due to human negligence.

[0003] While existing technologies include virtual terminal testing methods based on SCD files, such as verifying the correspondence between SV virtual terminals and telemetry signals through closed-loop testing, these methods are limited to passive testing during the commissioning phase and cannot detect problems in the early stages of configuration file generation. Furthermore, while graph neural network-based fault location technology can diagnose loop faults, it focuses on tracing faults during operation rather than pre-configuration verification. Additionally, while automatic remote signaling alignment technology can improve verification efficiency, it does not address the issue of pre-verification of the configuration file's compliance, requiring on-site testing before device commissioning. The internal short address of the virtual terminal, as the core identifier for signal transmission in the telemetry and control device, directly relates to the acquisition and output logic of telemetry and remote control signals; its configuration standardization determines the accuracy of the telemetry and remote control information. Existing technologies do not fully utilize this core identifier to build a standardized verification model, resulting in configuration errors often being discovered only during the acceptance phase, increasing rectification costs and commissioning time. Therefore, there is an urgent need for a pre-verification technology based on the core identifier of the virtual terminal, using machine learning to automate problem identification during the configuration phase. Summary of the Invention

[0004] The purpose of this invention is to provide a machine learning-based method for verifying remote information of telemetry and control devices. This method can perform automated pre-verification to avoid passive verification during the commissioning and acceptance process and shorten the time for verifying remote information.

[0005] To achieve the above objectives, embodiments of the present invention provide a method for verifying the second-level remote information of a telemetry and control device based on machine learning. The method includes: Collect SCD files of various types of measurement and control devices, and simultaneously collect data information such as qualified configuration records and fault rectification files of the operational devices; Data extraction is performed on the collected SCD files and data information to obtain a structured feature matrix combining identifier data, signal attribute data, and topological correlation data; The structured feature matrix is ​​input into the isolated forest model to obtain the corresponding anomaly score; The structured feature matrix and the corresponding anomaly score for anomaly scores greater than a preset threshold are fed into the XGBoost model as additional features to obtain the corresponding anomaly category. Based on the corresponding anomaly category, the structured feature matrix corresponding to the anomaly category is fed into the category tracing model to obtain the anomaly root cause in the structured feature matrix.

[0006] Optionally, the identification data includes: the internal short address of the virtual terminal, the device model ID, and the voltage level code; the signal attribute data includes: signal type, telemetry measurement value, accuracy threshold, quality, time stamp, remote control switch status, gear status, and pressure plate configuration; the topology association data includes: upstream short address association relationship, loop interval division information, and device connection port parameters.

[0007] Optionally, the structured feature matrix is ​​input into the isolated forest model to obtain the corresponding anomaly score, including: Obtain the structured feature matrix, and obtain the short internal addresses of all virtual terminals within the same interval in the structured feature matrix; Calculate the topological connectivity between all pairs of short addresses within the virtual terminals based on the loop connection relationships parsed from the SCD file: Formula (1), in, Indicates the internal short address of the virtual terminal and virtual terminal internal short address Topological connectivity between them Indicates the internal short address of the virtual terminal and The number of indirect connections between them, and the number of such connections is greater than 0. Indicates control parameters; Calculate the Pearson correlation coefficient between all pairs of short addresses within the virtual terminals based on historical operating data; Based on the topological connectivity and Pearson correlation coefficient, the final correlation degree between all pairs of short addresses within the virtual terminals is obtained using formula (2); Formula (2), in, Indicates the internal short address of the virtual terminal and The final degree of correlation, , Represents the weight parameters. Indicates the internal short address of the virtual terminal and The Pearson correlation coefficient between them; Iterate through all pairs of short addresses within the virtual terminals and calculate the final correlation degree for each pair. Binary clustering is performed based on the final correlation of each pair of combinations, and the final correlation of the cluster center that exceeds the preset threshold is used as the high correlation threshold. Combinations exceeding a high relevance threshold are selected to form a set of short addresses with high relevance, and the set of short addresses with high relevance is deduplicated. Clustering is performed on the deduplicated set of highly correlated short addresses to obtain the preferred input data for the isolated forest model.

[0008] Optionally, the deduplicated set of highly correlated short addresses is clustered to obtain the preferred input data for the isolated forest model, including: Obtain the set of highly relevant short addresses after deduplication; The multidimensional feature vectors in the highly correlated short addresses are used as input to construct a clustering sample matrix; Traverse each short address sample in the clustering sample matrix and determine the number of samples within its neighborhood radius; Short address samples with a sample size greater than the minimum sample size are marked as core points to form initial cluster cores, and all short address samples within the neighborhood radius of the initial cluster cores are grouped into the same cluster. Clusters with fewer than a preset threshold of samples are removed to obtain effective clusters, and the cluster sample matrix corresponding to the short address samples within the cluster is used as the associated short address subset. The associated short address subset is assigned a higher path splitting priority and used as the preferred input data for the isolated forest model.

[0009] Optionally, the structured feature matrix is ​​input into the isolated forest model to obtain the corresponding anomaly score, including: Obtain the priority input data, and randomly sample from the priority input data as samples to form the sample set of the current split node; Based on the multidimensional features of the samples in the sample set, they are divided into topological correlation features and non-topological features, and candidate features are randomly extracted from the two types of features according to a preset ratio. Calculate the variance inflation factor (VIF) of the candidate features, and select the feature with the smallest VIF as the splitting feature for this time; Based on the selected splitting feature, calculate the quartiles Q1 and Q3 of the selected splitting feature, and determine the splitting range as [Q1-1.5×IQR, Q3+1.5×IQR], where IQR=Q3-Q1, which is the interquartile range; Within the splitting range, a uniformly distributed data point is randomly generated as the splitting point. The sample set is divided into two sub-sample sets according to the split point. Based on the sub-sample sets, multi-dimensional features based on the sample set are returned, which are divided into topological features and non-topological features. Candidate features are randomly extracted from the two types of features according to a preset ratio. The splitting is stopped when any one of the following three conditions is met: the sub-sample set is less than a preset threshold, the feature vectors of all samples in the sub-sample set are completely consistent, or the recursion depth reaches a preset threshold. The node containing the current subsample set is designated as the leaf node, and the number of samples and the sample list within the leaf node are recorded. At the same time, the number of steps is marked for each splitting path. Traverse all decision trees and assign path length weights to each sample. Based on the path length weights and the number of labeled steps, obtain the average path length. The average path length is mapped to anomaly scores.

[0010] Optionally, all decision trees are traversed and path length weights are assigned to each sample. Based on the path length weights and the number of labeled steps, the average path length is obtained, including: Obtain the samples within the leaf nodes, and calculate the initial length weights of the samples using formula (3): Formula (3), in, Indicates path length weight. Indicates the weighting coefficient. Indicates the strength of topological association. Indicates the contribution of feature importance; The obtained initial length weights are normalized to obtain the path length weights for the mapping interval [0.8, 1.2]. The path length of a sample in a single tree is obtained by multiplying the obtained path length weight with the corresponding number of steps. Traverse all decision trees and calculate the average path length of the sample in the tree using formula (4): Formula (4), in, This represents the average path length within the tree containing the sample. This represents the total number of decision trees integrated in an isolated forest. Let represent the weighted path length of sample s in the t-th decision tree, which is the number of steps the sample takes from the root node to a leaf node in a single tree. Indicates the index number of the decision tree.

[0011] Optionally, mapping the average path length to anomaly scores includes: Obtain the average path length and expected average path length in the tree containing the sample; The average path length is converted into a probability value of 0-1 according to formula (5): Formula (5), in, Represents the probability value. Indicates the average path length. This represents the expected value of the average path length; The obtained probability values ​​are mapped to an anomaly score of 0-100.

[0012] Optionally, the structured feature matrix with anomaly scores greater than a preset threshold and the corresponding anomaly scores are fed as additional features into the XGBoost model to obtain the corresponding anomaly categories, including: Samples containing 8 types of anomaly labels are fed into the XGBoost model to train the XGBoost model, and the Huber loss function is used to optimize the XGBoost model. After training is completed, the structured feature matrix with anomaly scores greater than a preset threshold and the corresponding anomaly scores are sent as samples to be verified into the XGBoost model. The XGBoost model outputs eight unnormalized raw scores for the sample to be verified, which correspond to the raw matching degree of the eight anomalies respectively. The softmax function transforms the eight raw scores into a probability distribution using formula (6) to obtain the preliminary probability that each sample belongs to each type of anomaly: Formula (6), in, This represents the initial probability that the sample to be verified belongs to the k-th type of anomaly. This represents the original score of the sample to be verified corresponding to the k-th type of anomaly. Indicates the category of the exception. Indicates the first The raw score of the exception class; The category with the highest initial probability and greater than the preset threshold is selected as the predicted anomaly type of the sample to be verified.

[0013] Optionally, the XGBoost model is optimized using the Huber loss function, including: The XGBoost model is optimized using the Huber loss function shown in Equation (7): Formula (7), in, The Huber loss value represents the magnitude of the loss corresponding to the model's prediction error, and is the core objective of optimization. This represents the model prediction error. Indicates the error threshold; A short address conflict penalty factor is added to formula (7) to construct the Huber loss function: Formula (8), in, This represents the weighted Huber loss value, which amplifies the loss due to key anomalies through a penalty factor, allowing the model to prioritize optimization. The penalty factor is 2 when the sample belongs to the short address duplicate mapping anomaly, and 1 when it belongs to other anomalies.

[0014] Optionally, based on the corresponding anomaly category, the structured feature matrix corresponding to the anomaly category is fed into the category tracing model to obtain the anomaly root cause in the structured feature matrix, including: Obtain the structured feature matrix and feed it into the Tree SHAP interpreter to calculate the contribution of the features in the structured feature matrix to the current anomaly classification result using formula (9): Formula (9), in, Indicates the first The output of the anomaly classification prediction for sample v, i.e., the contribution, Indicates the baseline value. Indicates the first Each feature for the sample The SHAP value is positive, indicating that the feature promotes the classification of the sample as an anomaly, and negative, indicating that the feature inhibits the classification of anomalies. The larger the absolute value, the stronger the contribution. The contribution of each feature is normalized to obtain a normalized contribution score, and the features in the structured feature matrix are sorted in descending order based on the normalized contribution score. Features with normalized contribution scores ranked in the top preset positions, and whose SHAP values ​​are positive and whose absolute values ​​exceed preset thresholds are used as the root causes of anomalies.

[0015] Through the above technical solution, the present invention provides a machine learning-based method for verifying remote sensing information of telemetry and control devices. This method can collect SCD files from multiple types of telemetry and control devices and simultaneously collect data information from qualified configuration records and fault rectification files of operational devices. Data extraction can be performed on the collected SCD files and data information to obtain a structured feature matrix combining identifier data, signal attribute data, and topological association data. After obtaining the structured feature matrix, it can be input into an isolated forest model to obtain the corresponding anomaly score. After obtaining the anomaly score, the structured feature matrix with anomaly scores greater than a preset threshold and the corresponding anomaly scores can be used as additional feature data in an XGBoost model to obtain the corresponding anomaly category. Based on the corresponding anomaly category, the structured feature matrix corresponding to that anomaly category can be sent to a category tracing model to obtain the anomaly basis in the structured feature matrix, thus completing the source tracing of the anomaly. This method for verifying remote sensing information of telemetry and control devices can complete automated pre-verification, avoiding passive verification in the commissioning and acceptance process and shortening the time for verifying remote sensing information.

[0016] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a machine learning-based remote information verification method for a telemetry and control device according to an embodiment of the present invention; Figure 2 This is a first flowchart of an anomaly score acquisition method for a telemetry and control device based on machine learning, according to an embodiment of the present invention. Figure 3 This is a second flowchart of an anomaly score acquisition method for a telemetry and control device based on machine learning, according to an embodiment of the present invention. Figure 4 This is a third flowchart of an anomaly score acquisition method for a remote information verification method for a telemetry and control device based on machine learning, according to an embodiment of the present invention. Detailed Implementation

[0018] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0019] In the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the solution.

[0020] Figure 1 This is a flowchart of a machine learning-based remote sensing information verification method for a telemetry and control device according to an embodiment of the present invention. In this invention, the information verification process may include: In step S1, SCD files of various types of measurement and control devices are collected, and data information such as qualified configuration records and fault rectification files of the operational devices are collected at the same time.

[0021] In step S2, data extraction is performed on the collected SCD file and data information to obtain a structured feature matrix combining identifier data, signal attribute data and topological correlation data.

[0022] In step S3, the structured feature matrix is ​​input into the isolated forest model to obtain the corresponding anomaly score.

[0023] In step S4, the structured feature matrix with an anomaly score greater than a preset threshold and the corresponding anomaly score are fed into the XGBoost model as additional features to obtain the corresponding anomaly category.

[0024] In step S5, based on the corresponding anomaly category, the structured feature matrix corresponding to the anomaly category is sent into the category tracing model to obtain the anomaly root cause in the structured feature matrix.

[0025] In this invention, during verification, SCD files of various types of telemetry and control devices can be collected, along with data information from qualified configuration records and fault rectification files of operational devices. Data extraction can be performed on the collected SCD files and data information to obtain a structured feature matrix combining identifier data, signal attribute data, and topological association data. After obtaining the structured feature matrix, it can be input into an isolated forest model to obtain the corresponding anomaly score. After obtaining the anomaly score, structured feature matrices with anomaly scores greater than a preset threshold and the corresponding anomaly scores can be used as additional feature data in an XGBoost model to obtain the corresponding anomaly category. Based on the corresponding anomaly category, the structured feature matrix corresponding to that anomaly category can be sent to a category tracing model to obtain the anomaly basis in the structured feature matrix, thus completing the anomaly tracing. This telemetry and control device remote information verification method can complete automated pre-verification, avoiding passive verification in the commissioning and acceptance phase and shortening the remote information verification time.

[0026] In this invention, the collected data can be divided into identification data, signal attribute data, and topology association data. Identification data may include the internal short address of the virtual terminal, device model ID, and voltage level code. The internal short address of the virtual terminal may be a core index. Signal attribute data may include: signal type (e.g., telemetry / remote control), telemetry measurement value, accuracy threshold, quality, timestamp, remote control switch status, gear status, and pressure plate configuration. Topology association data may include upstream short address association relationships, loop interval division information, and device connection port parameters. The above data comprises a total of 12 dimensions.

[0027] When extracting data, unstructured data (such as loop relationships described in text) can be converted into a structured format, for example, using numerical encoding to represent loop levels (interval 1=1, interval 2=2, etc.), ensuring that the data is computable. A unique index can be used within the virtual terminal's internal short address to associate a 12-dimensional feature dimension (consistent with the subsequent model input features), achieving a "one index, one feature vector" mapping. Specific alignment rules include: 1. Each virtual terminal's internal short address corresponds to one sample record, serving as one row of the feature matrix; 2. The 12-dimensional feature dimension serves as columns of the structured feature matrix, including 3-dimensional basic attribute features, 4-dimensional telemetry-specific features (this column is filled with adaptive values ​​for remote control samples), 3-dimensional remote control-specific features (this column is filled with adaptive values ​​for telemetry samples), and 2-dimensional topological association features; 3. Forced feature dimension alignment: If a certain type of device lacks some non-core features (such as some older models lacking "time stamp" data), it is marked as "to be supplemented," and the column is not directly deleted, ensuring a consistent matrix structure.

[0028] To ensure the quality of the structured feature matrix, invalid samples can be removed using a dual standard of "physical rules + logical rules." Specific operations include: 1. Definition of removal rules: Absolutely invalid samples: The short address inside the virtual terminal is empty, the device model ID is missing, and the signal type is not marked (neither telemetry nor remote control).

[0029] Physical limit anomaly samples: telemetry accuracy threshold <0.1% or >10% (exceeding the general physical range of industry), remote control gear <1 or >5 (not in line with conventional gear design), upstream short address correlation <0 or >1 (logic anomaly after standardization).

[0030] Logical conflict sample: Duplicate virtual terminal internal short addresses appear in the same device, and the signal type encoding contradicts the actual signal attributes (e.g., the encoding is telemetry but contains remote control gear parameters).

[0031] 2. Rejection procedure: Iterate through all extracted data, mark them according to the above rules, and generate an "abnormal sample list".

[0032] Samples marked as "absolutely invalid", "physical limit anomaly", or "logical conflict" are directly removed and not proceeded to further processing.

[0033] Record the reasons for removal (such as "duplicate short address" or "precision threshold exceeded") to form a data cleaning log for easy traceability.

[0034] For missing values ​​in the cleaned samples (not invalid samples, only some feature dimensions are missing), they can be classified and processed according to "categorical features + numerical features" to ensure a feature matrix without empty values: 1. Numerical feature imputation (8 dimensions): Screening criteria: Historical qualified samples with the same device model ID and voltage level (the sample size should be no less than 50; if insufficient, expand to all models with the same voltage level).

[0035] Filling method: Calculate the median of the screened samples (to resist outlier interference) and fill the missing values ​​with the median; for example, if the "accuracy threshold" of a certain telemetry sample is missing, take the median of the accuracy threshold of 50 qualified samples of the same model to fill it.

[0036] 2. Categorical feature imputation (4 dimensions): Screening criteria: Historical qualified samples with the same device model ID and the same signal type.

[0037] Filling method: Calculate the mode of the selected samples (the value that appears most frequently) and use the mode to fill the missing values; for example, if a sample is missing the "loop level code", take the code that appears most frequently in the same type of telemetry sample to fill it.

[0038] 3. Filling and verification: After filling, verify again to ensure that no missing values ​​are omitted. If a sample still has logical contradictions after filling (such as the precision threshold after filling exceeding the physical range), it will be directly removed.

[0039] To eliminate dimensional differences between feature dimensions (e.g., measurement values ​​of several hundred with correlation degrees of 0-1), the structured feature matrix can be standardized. Specific methods include: 1. For numerical features (8 dimensions), robust standardization can be used to complete the standardization.

[0040] 2. Categorical Features (4-dimensional): Target Encoding is used, replacing the original encoding with the mean of the anomaly label corresponding to the feature value, while adding 5% Gaussian noise (e.g., if the original encoding is 1, it becomes 1±0.05 after processing) to prevent overfitting in subsequent models.

[0041] 3. Standardized range control: Ensure that the value range of numerical features after processing is concentrated between [-3,3] and the value range of categorical features is concentrated between [0,2]. Samples that exceed this range should be re-examined and cleaned.

[0042] Anomaly labeling: Based on eight defined typical anomaly types (such as short address mapping errors, loop topology mismatches, and exceeding precision thresholds), samples can be labeled. Qualified samples: those with a label of 0, corresponding to historical operational configurations without any abnormalities; Abnormal samples: Labeled as 1-8 (corresponding to 8 types of abnormalities), including historical fault rectification cases and artificially constructed typical abnormal cases (such as deliberately setting duplicate short addresses, mismatched topology parameters, etc.).

[0043] In one embodiment of the present invention, such as Figure 2 As shown, the first step in obtaining anomaly scores may include: In step S6, the structured feature matrix is ​​obtained, and the internal short addresses of all virtual terminals within the same interval in the structured feature matrix are obtained.

[0044] In step S7, the topological connectivity between all pairs of short addresses within all virtual terminals is calculated based on the loop connection relationships parsed from the SCD file: Formula (1), in, Indicates the internal short address of the virtual terminal and virtual terminal internal short address Topological connectivity between them Indicates the internal short address of the virtual terminal and The number of indirect connections between them, and the number of such connections is greater than 0. This indicates the control parameters.

[0045] In step S8, the Pearson correlation coefficient between each pair of short addresses within all virtual terminals is calculated based on historical operating data.

[0046] In step S9, the final correlation degree between all pairs of short addresses inside the virtual terminals is obtained by formula (2) based on topological connectivity and Pearson correlation coefficient. Formula (2), in, Indicates the internal short address of the virtual terminal and The final degree of correlation, , Represents the weight parameters. Indicates the internal short address of the virtual terminal and The Pearson correlation coefficient between them.

[0047] In step S10, all pairs of short addresses inside the virtual terminals are traversed, and the final correlation degree of each pair is calculated.

[0048] In step S11, binary clustering is performed based on the final correlation degree of each pair of combinations, and the final correlation degree corresponding to the cluster center that exceeds the preset threshold is used as the high correlation degree threshold.

[0049] In step S12, combinations exceeding the high relevance threshold are selected to form a set of short addresses with high relevance, and the set of short addresses with high relevance is deduplicated.

[0050] In step S13, the set of highly correlated short addresses after deduplication is clustered to obtain the priority input data for the isolated forest model.

[0051] In this invention, when obtaining anomaly scores, the input data needs to be processed first. During processing, a structured feature matrix can be obtained first, and then the internal short addresses of all virtual terminals within the same interval in the structured feature matrix can be obtained. After obtaining the internal short addresses of the virtual terminals, the topological connectivity between all pairs of internal short addresses of the virtual terminals can be calculated based on the loop connection relationship parsed from the SCD file. Then, the Pearson correlation coefficient between all pairs of internal short addresses of the virtual terminals can be calculated based on historical running data. Based on the topological connectivity and the Pearson correlation coefficient, the final correlation degree between all pairs of internal short addresses of the virtual terminals can be obtained through formula (2). After obtaining the final correlation degree, all pairs of internal short addresses of the virtual terminals can be traversed, and the final correlation degree of each pair of pairs can be calculated. Based on the final correlation degree of each pair of pairs of pairs, binary clustering can be performed. The final correlation degree corresponding to the cluster center that exceeds a preset threshold is used as the high correlation degree threshold. Then, combinations that exceed the high correlation degree threshold can be filtered to form a set of high correlation short addresses, and the high correlation short address set can be deduplicated. Clustering can be performed on the deduplicated set of highly correlated short addresses to obtain the preferred input data for the isolated forest model.

[0052] When evaluating the correlation, two indicators, "topological connectivity" and "operational data synergy," can be selected to quantify the correlation of short addresses. Topological connectivity accounts for 60% of the weight, and operational data synergy accounts for 40%. Topological connectivity is calculated based on the loop connection relationship parsed from the SCD file (direct connection is 1.0, indirect connection is 0.6-0.9, and no connection is 0). Operational data synergy is obtained by calculating the Pearson correlation coefficient of historical operational data over the past 3 months (the value ranges from -1 to 1, with a larger absolute value indicating stronger synergy). The final correlation = topological connectivity × 0.6 + |Pearson correlation coefficient| × 0.4.

[0053] During the calculation, sample data of all short addresses within the same interval can be extracted from the structured feature matrix, with the screening condition being "consistent interval encoding". Invalid data (such as short addresses with a missing rate of more than 30% in the running data) are removed, and the running indicators of the remaining data (such as telemetry measurement values ​​and remote control status switching frequency) are standardized (using the robust standardization method in step 5) to ensure that the indicator dimensions are consistent.

[0054] When calculating the correlation, all short addresses within the same interval can be paired and the correlation of each pair can be calculated. K-means clustering is used to help determine the high correlation threshold. The correlation values ​​of all combinations are used as input for binary clustering. The larger value corresponding to the cluster center is the high correlation threshold (usually 0.7, which can be fine-tuned according to the characteristics of different voltage level intervals. The threshold for 110kV intervals can be reduced to 0.65, and the threshold for 220kV and above intervals can be increased to 0.75).

[0055] When filtering short addresses based on their relevance to the manuscript, short address combinations with relevance ≥ the threshold can be retained to form a "high relevance short address set". The set is then deduplicated to ensure that each short address belongs to only one set (if there is cross-assignment, the set with higher topological connectivity is retained first).

[0056] In one embodiment of the present invention, such as Figure 3 As shown, the second process for obtaining anomaly scores may include: In step S14, a set of highly relevant short addresses after deduplication is obtained.

[0057] In step S15, the multidimensional feature vectors in the highly correlated short addresses are used as input to construct a clustering sample matrix.

[0058] In step S16, each short address sample in the clustering sample matrix is ​​traversed to determine the number of samples within its neighborhood radius.

[0059] In step S17, short address samples with a sample number greater than the minimum sample number are marked as core points to form initial cluster cores, and all short address samples within the neighborhood radius of the initial cluster cores are grouped into the same cluster.

[0060] In step S18, clusters with fewer than a preset threshold of samples are removed to obtain effective clusters, and the cluster sample matrix corresponding to the short address samples within the cluster is used as the associated short address subset.

[0061] In step S19, the associated short address subset is given a higher path splitting priority and used as the priority input data for the isolated forest model.

[0062] In this invention, during clustering, a set of highly correlated short addresses after deduplication can be obtained. The multidimensional feature vectors of these highly correlated short addresses can be used as input to construct a clustering sample matrix. Each short address sample in the clustering sample matrix is ​​traversed to determine the number of samples within its neighborhood radius. Short address samples with a sample number greater than the minimum sample number can be marked as core points, forming initial cluster cores. All short address samples within the neighborhood radius of the initial cluster cores can be grouped into the same cluster. After classification, clusters with a sample number less than a preset threshold can be removed to obtain effective clusters. The clustering sample matrix corresponding to the short address samples within each cluster can be used as a subset of correlated short addresses. This subset of correlated short addresses can be assigned a higher path splitting priority and used as priority input data for the isolated forest model.

[0063] For clustering, the improved DBSCAN (density clustering) algorithm can be used. This algorithm does not require pre-specifying the number of clusters and is suitable for the irregular distribution characteristics of short address associations. The core parameters are set as follows: neighborhood radius ε = 0.3 (determined based on the standard deviation of the average association degree of short addresses at the same interval), minimum sample size MinPts = 5 (to ensure the stability of the clustering results; the interval can be adjusted to 3 if the sample size is less than 5). After setting, the 12-dimensional feature vectors of each short address in the "high-association short address set" can be used as input to construct the clustering sample matrix. To strengthen the weight of topological characteristics, the topological association features (2-dimensional) are weighted (weight coefficient = 1.2), while the weights of other features remain at 1.0. During clustering, each short address sample in the clustering sample matrix can be traversed to determine the number of samples in its ε-neighborhood. Then, samples with a neighborhood sample size ≥ MinPts are marked as core points, forming the initial cluster cores. All samples in the neighborhood of a core point can be grouped into the same cluster. Repeat the above steps until all samples are labeled (core points, boundary points) or identified as noise points (isolated short addresses without neighboring samples, which are classified into a separate class), thus completing the clustering.

[0064] After clustering is completed, the clustering results can be optimized and verified. Specifically: remove clusters with a sample size < 3 (considered as abnormal isolated short addresses and processed separately); calculate the silhouette coefficient of each cluster (value range [-1, 1]), clusters with a silhouette coefficient ≥ 0.5 are considered valid (indicating high similarity of samples within the cluster and significant differences between clusters), and clusters < 0.5 need to readjust the ε and MinPts parameters and re-cluster; verify the clustering results with manual experience to ensure that the clusters conform to the actual loop topology logic (e.g., protection short addresses and measurement and control short addresses should be classified into the same cluster, and short addresses of different functional modules should belong to different clusters).

[0065] After clustering is completed, higher path splitting priority can be assigned to short addresses with high correlation within the cluster (the higher the correlation strength, the greater the weight) to solve the problem of insufficient sensitivity of traditional isolated forests in detecting "small sample anomalies" (such as single-interval short address conflicts).

[0066] In one embodiment of the present invention, such as Figure 4 As shown, the third process for obtaining anomaly scores may include: In step S20, priority input data is obtained, and random samples are taken from the priority input data as samples to form the sample set of the current split node.

[0067] In step S21, based on the multidimensional features of the samples in the sample set, they are divided into topological correlation features and non-topological features, and candidate features are randomly extracted from the two types of features according to a preset ratio.

[0068] In step S22, the variance inflation factor (VIF) of the candidate features is calculated, and the feature with the smallest VIF is selected as the splitting feature for this time.

[0069] In step S23, based on the selected splitting feature, the quartiles Q1 and Q3 of the selected splitting feature are calculated, and the splitting range is determined as [Q1-1.5×IQR,Q3+1.5×IQR], where IQR=Q3-Q1 is the interquartile range.

[0070] In step S24, a uniformly distributed data point is randomly generated within the splitting range as the splitting point; In step S25, the sample set is divided into two sub-sample sets according to the split point, and multi-dimensional features based on the sample set are returned, which are divided into topological features and non-topological features. Candidate features are randomly extracted from the two types of features according to a preset ratio. The splitting stops when any one of the following three conditions is met: the sub-sample set is less than a preset threshold, the feature vectors of all samples in the sub-sample set are completely consistent, or the recursion depth reaches a preset threshold.

[0071] In step S26, the node containing the current subsample set is designated as a leaf node, and the number of samples and the sample list within the leaf node are recorded. At the same time, the number of steps is marked for each splitting path.

[0072] In step S27, all decision trees are traversed and path length weights are assigned to each sample. The average path length is obtained based on the path length weights and the number of labeled steps.

[0073] In step S28, the average path length is mapped to anomaly scores.

[0074] In this invention, when obtaining anomaly scores, priority input data can be acquired first, and random samples can be taken from the priority input data to form the sample set of the current split node. Based on the multidimensional features of the samples in the sample set, they can be divided into topological correlation features and non-topological features, and candidate features can be randomly extracted from the two types of features according to a preset ratio. The variance inflation factor (VIF) of the candidate features can be calculated, and the feature with the smallest VIF is selected as the split feature for this split. Based on the selected split feature, the quartiles Q1 and Q3 of the selected split feature are calculated, and the split range is determined. A uniformly distributed data point can be randomly generated within the split range as the split point. The sample set can be divided into two sub-sample sets according to the split point, and the process returns to step S21 based on the sub-sample sets until any one of the following three conditions is met: the sub-sample set is less than a preset threshold, the feature vectors of all samples in the sub-sample set are completely consistent, or the recursion depth reaches a preset threshold. Then, the split can be stopped. The node where the current sub-sample set is located can be designated as a leaf node, and the number of samples and the sample list within the leaf node are recorded. At the same time, the number of steps is marked for each split path. It can traverse all decision trees and assign path length weights to each sample, and obtain the average path length based on the path length weights and the number of labeled steps, and then map the average path length to anomaly scores.

[0075] When performing anomaly analysis using an isolation forest, the core logic is that anomalous samples are more "isolated" in the feature space, and will be partitioned into leaf nodes by the decision tree more quickly, resulting in shorter path lengths. The path length calculation for a single tree is as follows: The preprocessed feature vector is input into each decision tree of the isolation forest. Starting from the root node, the tree traverses according to the rule of "high-weight features first, then splits," until a leaf node is reached, and the path length of that tree is recorded.

[0076] Average path length is a core indicator in the Isolation Forest model for determining the degree of sample anomaly. It represents the average number of path steps required for a sample to be isolated across all decision trees in the forest. Calculating the path length of a single tree is fundamental and requires a combination of splitting techniques and weight allocation rules to achieve accurate calculation. Specific details are as follows: The single tree is constructed using a recursive splitting mechanism. The splitting process achieves the gradual isolation of samples through specific technical means. At the same time, a weight coefficient is introduced to correct the path length, ensuring that the splitting logic of samples with strong topological correlations is more in line with the characteristics of actual loops.

[0077] During splitting, 256 samples are randomly sampled from the "associative short address subset" obtained from clustering (if the subset has fewer than 256 samples, all samples are used) to form the sample set of the current splitting node; the 12-dimensional feature vector of each sample and the corresponding topological association identifier (such as cluster ID, interval code) are recorded. A "hierarchical random selection + topological feature weighting" strategy is used to screen splitting features. First, the features are divided into two categories: "topological association features (2-dimensional)" and "non-topological features (10-dimensional)". Candidate features are randomly selected from the two categories in a 4:6 ratio (for example, 1 topological feature and 2 non-topological features are selected to form 3 candidate features). The final determination of candidate features requires calculating the feature discrimination (using the variance inflation factor VIF, the smaller the VIF, the stronger the discrimination), and the feature with the smallest VIF is selected as the splitting feature for this time.

[0078] Split point determination: Based on the selected splitting feature, the "interquartile range method" is used to determine the splitting threshold. First, the quartiles Q1 (lower quartile) and Q3 (upper quartile) of the feature in the current sample set are calculated, and the splitting range is determined to be [Q1-1.5×IQR, Q3+1.5×IQR] (IQR=Q3-Q1, i.e., the interquartile range, used to filter out interference from abnormal feature values); then, a uniformly distributed value is randomly generated within this range as the splitting point, ensuring that the splitting point conforms to the data distribution pattern and also has randomness.

[0079] Recursive splitting execution and stopping conditions: Divide the current sample set into two sub-sample sets (left and right sub-sample sets) according to the split point (feature values ​​≤ split point are assigned to the left subtree, and feature values ​​> split point are assigned to the right subtree); repeat the above "feature selection - split point determination" process for the two sub-sample sets, recursively executing the splitting. The conditions for stopping the splitting are: ① Sub-sample set sample size ≤ 1 (cannot continue splitting); ② All samples in the sub-sample set have completely identical feature vectors (no need for splitting); ③ The recursion depth reaches a preset threshold (maximum depth = log2 (initial sample set size), to avoid overfitting due to an excessively deep tree structure).

[0080] Leaf node labeling: After the split stops, the node where the current subsample set is located is the leaf node, which records the number of samples (s_size) and the sample list in the leaf node; at the same time, the step count is marked for each split path (the step count is increased by 1 for each split on the path from the root node to the leaf node).

[0081] In one embodiment of the present invention, the process of obtaining the average path length may include: In step S29, samples within leaf nodes are obtained, and the initial length weights of the samples are calculated using formula (3): Formula (3), in, Indicates path length weight. Indicates the weighting coefficient. Indicates the strength of topological association. This indicates the contribution of the feature to its importance.

[0082] In step S30, the obtained initial length weights are normalized to obtain the path length weights in the mapping interval [0.8, 1.2].

[0083] In step S31, the path length of a sample in a single tree is obtained by multiplying the obtained path length weight with the corresponding number of steps.

[0084] In step S32, all decision trees are traversed, and the average path length in the tree containing the sample is calculated using formula (4): Formula (4), in, This represents the average path length within the tree containing the sample. This represents the total number of decision trees integrated in an isolated forest. Let represent the weighted path length of sample s in the t-th decision tree, which is the number of steps the sample takes from the root node to a leaf node in a single tree. Indicates the index number of the decision tree.

[0085] In this invention, when obtaining the average path length, samples within the leaf nodes can be obtained, and the initial length weight of the samples can be calculated using formula (3). After calculating the initial length weight, the obtained initial length weight can be normalized to obtain the path length weight with a mapping interval of [0.8, 1.2]. After mapping, the path length of the samples in a single tree can be obtained by multiplying the obtained path length weight with the corresponding number of steps. Then, all decision trees can be traversed, and the average path length in the tree where the sample is located can be calculated using formula (4).

[0086] The calculation of topological association strength (T) in formula (3) can include: the derivation of the "average association degree within a cluster" based on the aforementioned association degree, T = average association degree of the cluster in which the sample is located / maximum average association degree of all clusters in the same interval. For example, if the average association degree of the cluster in which sample A is located is 0.85, and the maximum average association degree of all clusters in the same interval is 0.9, then T = 0.85 / 0.9 ≈ 0.944, with a value range of (0,1]. The higher the association degree, the greater the weight.

[0087] The calculation of feature importance contribution (F) in formula (3) may include: pre-calculating the importance scores of the 12-dimensional features using the random forest algorithm (the sum of the feature importance scores is 1); for the current sample, F is the sum of the importance scores of all splitting features used in its splitting process. For example, if the splitting path of sample B uses "topological association feature 1" (importance score 0.12) and "telemetry accuracy feature" (importance score 0.08), then F = 0.12 + 0.08 = 0.2, with a value range of (0, 1).

[0088] After obtaining the initial length weights, min-max normalization can be used to map them to the interval [0.8, 1.2] (to avoid path length distortion caused by weights that are too small or too large).

[0089] In one embodiment of the present invention, the process of obtaining anomaly scores may include: In step S33, the average path length and the expected value of the average path length in the tree where the sample is located are obtained.

[0090] In step S34, the average path length is converted into a probability value of 0-1 according to formula (5): Formula (5), in, Represents the probability value. Indicates the average path length. This represents the expected value of the average path length.

[0091] In step S35, the obtained probability values ​​are mapped to an anomaly score of 0-100.

[0092] In this invention, the average path length can be converted into an intuitive score through nonlinear mapping, and the higher the score, the greater the probability of an anomaly. Theoretical expected value correction: The "expected value of average path length" μ(n) (a constant derived from the isolated forest theory, such as μ(n)≈8.9 when n=500) is introduced to correct the absolute deviation of the path length. Then, its probability value is calculated by formula (5), and the obtained probability value is mapped to an anomaly score of 0-100.

[0093] In one embodiment of the present invention, the process of obtaining the exception category may include: In step S36, samples containing 8 types of anomaly labels are fed into the XGBoost model to train the XGBoost model, and the Huber loss function is used to optimize the XGBoost model.

[0094] In step S37, after training is completed, the structured feature matrix with anomaly scores greater than a preset threshold and the corresponding anomaly scores are sent as samples to be verified into the XGBoost model.

[0095] In step S38, the XGBoost model outputs eight unnormalized raw scores for the sample to be verified, which correspond to the raw matching degree of the eight anomalies.

[0096] In step S39, the softmax function transforms the eight raw scores into a probability distribution using formula (6) to obtain the preliminary probability that each sample belongs to each type of anomaly: Formula (6), in, This represents the initial probability that the sample to be verified belongs to the k-th type of anomaly. This represents the original score of the sample to be verified corresponding to the k-th type of anomaly. Indicates the category of the exception. Indicates the first The raw score of the exception class.

[0097] In step S40, the category with the highest initial probability and greater than the preset threshold is selected as the predicted anomaly type of the sample to be verified.

[0098] In this invention, when obtaining the corresponding anomaly category, samples containing 8 anomaly labels can be fed into the XGBoost model to train the XGBoost model, and the Huber loss function can be used to optimize the XGBoost model. After training, the structured feature matrix with anomaly scores greater than a preset threshold and the corresponding anomaly scores can be fed into the XGBoost model as samples to be verified. The XGBoost model can output 8 unnormalized raw scores for the samples to be verified, which correspond to the raw matching degree of 8 anomalies respectively. The softmax function can convert the 8 raw scores into a probability distribution through formula (6) to obtain the preliminary probability of each sample belonging to each anomaly category. Then, the category with the highest preliminary probability and greater than the preset threshold can be selected as the predicted anomaly type of the sample to be verified and enter the subsequent anomaly tracing stage. If the confidence of all categories is ≤0.9, it is determined as "no clear anomaly type" and is not included in the final anomaly report (reducing false alarms).

[0099] The anomaly classification model is based on the XGBoost algorithm. Its core objective is to accurately classify high-risk samples (anomaly score > 80) selected from the Isolation Forest algorithm into eight typical anomaly categories. As a tree ensemble learning algorithm, XGBoost, for multi-class classification tasks involving eight anomalies, requires five core steps to achieve accurate classification: feature expansion, model configuration, loss optimization, iterative training, and classification inference. The specific process is as follows: Multi-class model core configuration: To adapt to the 8 types of anomaly classification tasks, specific parameters and objective functions need to be configured. Specific settings are as follows: 1. Core parameter configuration: Objective function: set to multi:softprob, representing the probability output pattern of the multi-class classification task, and finally outputting the probability distribution of each sample belonging to 8 types of anomalies (the sum is 1). Number of categories (num_class): Set to 8, corresponding to the 8 typical exceptions defined in the document (short address mapping error, loop topology mismatch, etc.). Tree structure parameters: The optimal values ​​are obtained through grid search optimization (document hyperparameter range: max_depth=3-10, learning_rate=0.01-0.1, subsample=0.7-1.0). For example, the final configuration is max_depth=6, learning_rate=0.05, subsample=0.8, which balances the model's fitting ability and generalization ability. Regularization parameters: gamma (node ​​splitting penalty) and lambda (L2 regularization) are enabled by default to prevent overfitting.

[0100] 2. Loss function optimization: Basic loss: The Huber loss function is used. 3. Customized penalty: Introduce a "short address conflict penalty factor" to set the loss weight of samples labeled as "short address mapping error" to 2.0 (the weight of other samples is 1.0) to enhance the model's sensitivity to such high-frequency serious anomalies.

[0101] The optimization and convergence process of the XGBoost model: The training process aims to improve the average F1-score of ≥0.95 for all 8 anomalies and is carried out in the following steps: 1. Sample splitting: The labeled training set (containing samples with 8 types of anomaly labels) is divided into a training set and a validation set in a 7:3 ratio to ensure that the samples of each type of anomaly and each type of device model are evenly distributed in the two groups (to avoid model bias). 2. Tree integration construction: Decision tree generation: Based on the gradient boosting strategy, each new tree fits the residual (prediction error) of the previous model. When splitting a node, the feature with the "maximum feature gain" (such as short address correlation, accuracy threshold, etc.) is selected first. Regularization constraints: By controlling the maximum depth of the tree (max_depth), the sample sampling ratio (subsample), and the column sampling ratio (colsample_bytree), the complexity of a single tree is limited to prevent overfitting; Early stopping mechanism: Set early_stopping_rounds=50. If the average F1-score on the validation set does not improve for 50 consecutive rounds, stop training and retain the current best model (to avoid invalid iterations). Incremental update: New qualified / abnormal samples (manually reviewed and marked) are imported monthly. A sliding window (1000 samples / window) is used to retain data from the most recent 6 months. The old model is replaced only when the accuracy of the new model on the test set is improved by ≥3% (to ensure that the model is adapted to the new device model and configuration scenario).

[0102] In this invention, the optimized process may include: In step S41, the XGBoost model is optimized using the Huber loss function shown in formula (7): Formula (7), in, The Huber loss value represents the magnitude of the loss corresponding to the model's prediction error, and is the core objective of optimization. This represents the model prediction error. Indicates the error threshold; In step S42, a short address conflict penalty factor is added to formula (7) to construct the Huber loss function: Formula (8), in, This represents the weighted Huber loss value, which amplifies the loss due to key anomalies through a penalty factor, allowing the model to prioritize optimization. The penalty factor is 2 when the sample belongs to the short address duplicate mapping anomaly, and 1 when it belongs to other anomalies.

[0103] During optimization, the Huber loss function is used to reduce the interference of extreme outliers on model training. At the same time, a "short address conflict penalty factor" is introduced to apply a 2x loss weight to samples with repeated short address mappings, thereby strengthening the identification of high-frequency severe anomalies. The Huber loss function is a piecewise function. Its core advantage is that it maintains the smoothness of the squared loss when the error is small (which is beneficial for gradient optimization), and switches to linear loss when the error is large (which suppresses the excessive influence of extreme outliers). Therefore, the XGBoost model can be optimized using formula (7).

[0104] For ordinary samples (non-extreme outliers): when the error |e| ≤ δ, squared loss is used for optimization to ensure the model accurately fits the differences in normal configurations. For extreme outliers (such as severely out-of-limit parameters or spurious configurations): when the error |e| > δ, linear loss is used to limit the gradient magnitude to prevent these samples from dominating the model training direction, thus solving the problem of traditional squared loss being sensitive to extreme values. For high-frequency severe anomalies such as "short address duplicate mappings," the model's attention to these anomalies is strengthened through loss weighting.

[0105] To enhance the identification of high-frequency severe anomalies such as "short address duplicate mapping", a short address conflict penalty factor is introduced into the Huber loss function, thus enabling the construction of formula (8). Its core function is to double the loss value of short address conflict samples. During gradient descent, the model will prioritize minimizing the loss of such samples, thereby improving the sensitivity of identifying this type of high-frequency severe anomaly (reducing the false negative rate).

[0106] The Huber loss function needs to be adapted to the gradient calculation logic of XGBoost. The specific execution steps are as follows: 1. Forward Propagation: XGBoost outputs the anomaly probability prediction of samples through decision tree ensemble. (The range is 0 to 1, with the closer to 1 indicating a higher probability of an anomaly). 2. Error Calculation: For labeled samples (abnormal labels) (Abnormal = 1, Normal = 0), calculation error ; 3. Loss Calculation: like : ; like : ; 4. Gradient backpropagation: Calculate the first and second derivatives based on the above loss values, and substitute them into the XGBoost objective function to perform decision tree splitting and parameter updates; 5. Iterative optimization: After each round of training, the fit of the loss function is evaluated using the F1-score on the validation set. In one embodiment of the present invention, the process of obtaining the root cause of the anomaly may include: In step S43, the structured feature matrix is ​​obtained and fed into the Tree SHAP interpreter to calculate the contribution of the features in the structured feature matrix to the current anomaly classification result using formula (9): Formula (9), in, Indicates the first The output of the anomaly classification prediction for sample v, i.e., the contribution, Indicates the baseline value. Indicates the first Each feature for the sample The SHAP value is a positive number indicating that the feature promotes the classification of the sample as an anomaly, and a negative number indicating that the feature inhibits the classification of anomalies. The larger the absolute value, the stronger the contribution.

[0107] In step S44, the contribution of the feature is normalized to obtain a normalized contribution score, and the features in the structured feature matrix are sorted in descending order based on the normalized contribution score.

[0108] In step S45, the feature that ranks in the top preset position with normalized contribution score and has a positive SHAP value and an absolute value exceeding a preset threshold is obtained as the root cause of the anomaly.

[0109] In this invention, when obtaining the root cause of an anomaly, a structured feature matrix can be obtained first, and then the structured feature matrix can be sent to the Tree SHAP interpreter to calculate the contribution of the features in the structured feature matrix to the current anomaly classification result using formula (9). Then, the contribution of the features can be normalized to obtain a normalized contribution score, and the features in the structured feature matrix can be sorted in descending order using SHAP values. After sorting, the features ranked in the top preset position and whose sum of normalized contribution scores is less than a preset threshold can be obtained as the root cause of the anomaly.

[0110] Since the anomaly classification model in this invention uses XGBoost (tree ensemble model), the Tree SHAP algorithm (an efficient SHAP implementation specifically designed for tree models, with a computation speed 10-100 times faster than the general Kernel SHAP) is preferentially selected. The specific initialization steps are as follows: 1. Load the trained XGBoost model file (including optimized hyperparameters: max_depth, learning_rate, subsample, etc.); 2. Import the SHAP utility library (such as Python's shap package) and initialize the Tree SHAP interpreter: 3. Background data selection: Use qualified samples (default 1000) of the same model and voltage level from the standard circuit feature library as the reference benchmark to ensure the consistency of the benchmark for SHAP value calculation (avoiding deviation in contribution due to differences in background data).

[0111] Since the absolute value range of SHAP values ​​is related to the feature type (the magnitude of SHAP values ​​may differ between numerical and categorical features), the 12 SHAP values ​​of a single sample need to be normalized to a contribution score of 0-100. The 12 features are then sorted in descending order of their normalized contribution scores, and the top 3 features with the highest scores (i.e., the top 3 key features) are extracted. The original SHAP value of each key feature is recorded simultaneously, indicating whether it is positive or negative.

[0112] Positive SHAP value: The actual value of the feature deviates from the standard value (such as duplicate short addresses or exceeding the precision threshold), which directly drives the anomaly classification and is the core cause of anomalies.

[0113] Negative SHAP value: The actual value of the feature is close to the standard value, which suppresses the classification of anomalies. It is only included when other features strongly promote the anomaly, and is usually not listed as a core cause.

[0114] For each high-confidence outlier sample, generate a structured result containing the following information:

[0115] The top 3 key features (only the "push" type is retained) are used as the core input for anomaly tracing, and the subsequent process is carried out according to the "deviation calculation → rectification reference value determination" process in the document. If a key feature is categorized (such as signal type encoding), a positive SHAP value indicates that the feature encoding is inconsistent with the mode of the standard loop feature library, and it is directly marked as "type mismatch" and included in the deviation analysis.

[0116] Through the above technical solution, the present invention provides a machine learning-based method for verifying remote sensing information of telemetry and control devices. This method can collect SCD files from multiple types of telemetry and control devices and simultaneously collect data information from qualified configuration records and fault rectification files of operational devices. Data extraction can be performed on the collected SCD files and data information to obtain a structured feature matrix combining identifier data, signal attribute data, and topological association data. After obtaining the structured feature matrix, it can be input into an isolated forest model to obtain the corresponding anomaly score. After obtaining the anomaly score, the structured feature matrix with anomaly scores greater than a preset threshold and the corresponding anomaly scores can be used as additional feature data in an XGBoost model to obtain the corresponding anomaly category. Based on the corresponding anomaly category, the structured feature matrix corresponding to that anomaly category can be sent to a category tracing model to obtain the anomaly basis in the structured feature matrix, thus completing the source tracing of the anomaly. This method for verifying remote sensing information of telemetry and control devices can complete automated pre-verification, avoiding passive verification in the commissioning and acceptance process and shortening the time for verifying remote sensing information.

[0117] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0118] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0119] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0120] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0121] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0122] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0123] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0124] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0125] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for verifying remote sensing information of a telemetry and control device based on machine learning, characterized in that, The method for verifying remote information of the telemetry and control device includes: Collect SCD files of various types of measurement and control devices, and simultaneously collect data information such as qualified configuration records and fault rectification files of the operational devices; Data extraction is performed on the collected SCD files and data information to obtain a structured feature matrix combining identifier data, signal attribute data, and topological correlation data; The structured feature matrix is ​​input into the isolated forest model to obtain the corresponding anomaly score; The structured feature matrix and the corresponding anomaly score for anomaly scores greater than a preset threshold are fed into the XGBoost model as additional features to obtain the corresponding anomaly category. Based on the corresponding anomaly category, the structured feature matrix corresponding to the anomaly category is fed into the category tracing model to obtain the anomaly root cause in the structured feature matrix.

2. The method for verifying remote information of a telemetry and control device according to claim 1, characterized in that, Identification data includes: internal short address of virtual terminal, device model ID, and voltage level code; signal attribute data includes: signal type, telemetry measurement value, accuracy threshold, quality, time stamp, remote control switch status, gear status, and pressure plate configuration; topology association data includes: upstream short address association relationship, loop interval division information, and device connection port parameters.

3. The method for verifying remote information of a telemetry and control device according to claim 2, characterized in that, The structured feature matrix is ​​input into the isolated forest model to obtain the corresponding anomaly score, including: Obtain the structured feature matrix, and obtain the short internal addresses of all virtual terminals within the same interval in the structured feature matrix; Calculate the topological connectivity between all pairs of short addresses within the virtual terminals based on the loop connection relationships parsed from the SCD file: Official (1), in, Indicates the internal short address of the virtual terminal and virtual terminal internal short address Topological connectivity between them Indicates the internal short address of the virtual terminal and The number of indirect connections between them, and the number of such connections is greater than 0. Indicates control parameters; Calculate the Pearson correlation coefficient between all pairs of short addresses within the virtual terminals based on historical operating data; Based on the topological connectivity and Pearson correlation coefficient, the final correlation degree between all pairs of short addresses within the virtual terminals is obtained using formula (2); Official (2), in, Indicates the internal short address of the virtual terminal and The final degree of correlation, , Represents the weight parameters. Indicates the internal short address of the virtual terminal and The Pearson correlation coefficient between them; Iterate through all pairs of short addresses within the virtual terminals and calculate the final correlation degree for each pair. Binary clustering is performed based on the final correlation of each pair of combinations, and the final correlation of the cluster center that exceeds the preset threshold is used as the high correlation threshold. Combinations exceeding a high relevance threshold are selected to form a set of short addresses with high relevance, and the set of short addresses with high relevance is deduplicated. Clustering is performed on the deduplicated set of highly correlated short addresses to obtain the preferred input data for the isolated forest model.

4. The method for verifying remote information of a telemetry and control device according to claim 3, characterized in that, Clustering is performed on the deduplicated set of highly correlated short addresses to obtain the preferred input data for the isolated forest model, including: Obtain the set of highly relevant short addresses after deduplication; The multidimensional feature vectors in the highly correlated short addresses are used as input to construct a clustering sample matrix; Traverse each short address sample in the clustering sample matrix and determine the number of samples within its neighborhood radius; Short address samples with a sample size greater than the minimum sample size are marked as core points to form initial cluster cores, and all short address samples within the neighborhood radius of the initial cluster cores are grouped into the same cluster. Clusters with fewer than a preset threshold of samples are removed to obtain effective clusters, and the cluster sample matrix corresponding to the short address samples within the cluster is used as the associated short address subset. The associated short address subset is assigned a higher path splitting priority and used as the preferred input data for the isolated forest model.

5. The method for verifying remote information of a telemetry and control device according to claim 3, characterized in that, The structured feature matrix is ​​input into the isolated forest model to obtain the corresponding anomaly score, including: Obtain the priority input data, and randomly sample from the priority input data as samples to form the sample set of the current split node; Based on the multidimensional features of the samples in the sample set, they are divided into topological correlation features and non-topological features, and candidate features are randomly extracted from the two types of features according to a preset ratio. Calculate the variance inflation factor (VIF) of the candidate features, and select the feature with the smallest VIF as the splitting feature for this time; Based on the selected splitting feature, calculate the quartiles Q1 and Q3 of the selected splitting feature, and determine the splitting range as [Q1-1.5×IQR, Q3+1.5×IQR], where IQR=Q3-Q1, which is the interquartile range; Within the splitting range, a uniformly distributed data point is randomly generated as the splitting point. The sample set is divided into two sub-sample sets according to the split point. Based on the sub-sample sets, multi-dimensional features based on the sample set are returned, which are divided into topological features and non-topological features. Candidate features are randomly extracted from the two types of features according to a preset ratio. The splitting is stopped when any one of the following three conditions is met: the sub-sample set is less than a preset threshold, the feature vectors of all samples in the sub-sample set are completely consistent, or the recursion depth reaches a preset threshold. The node containing the current subsample set is designated as the leaf node, and the number of samples and the sample list within the leaf node are recorded. At the same time, the number of steps is marked for each splitting path. Traverse all decision trees and assign path length weights to each sample. Based on the path length weights and the number of labeled steps, obtain the average path length. The average path length is mapped to anomaly scores.

6. The method for verifying remote information of a telemetry and control device according to claim 5, characterized in that, Traverse all decision trees and assign path length weights to each sample. Based on the path length weights and the number of labeled steps, obtain the average path length, including: Obtain the samples within the leaf nodes, and calculate the initial length weights of the samples using formula (3): Official (3), in, Indicates path length weight. Indicates the weighting coefficient. Indicates the strength of topological association. Indicates the contribution of feature importance; The obtained initial length weights are normalized to obtain the path length weights for the mapping interval [0.8, 1.2]. The path length of a sample in a single tree is obtained by multiplying the obtained path length weight with the corresponding number of steps. Traverse all decision trees and calculate the average path length of the sample in the tree using formula (4): Official (4), in, This represents the average path length within the tree containing the sample. This represents the total number of decision trees integrated in an isolated forest. Let represent the weighted path length of sample s in the t-th decision tree, which is the number of steps the sample takes from the root node to a leaf node in a single tree. Indicates the index number of the decision tree.

7. The method for verifying remote information of a telemetry and control device according to claim 5, characterized in that, Mapping the average path length to anomaly scores includes: Obtain the average path length and expected average path length in the tree containing the sample; The average path length is converted into a probability value of 0-1 according to formula (5): Official (5), in, Represents the probability value. Indicates the average path length. This represents the expected value of the average path length; The obtained probability values ​​are mapped to an anomaly score of 0-100.

8. The method for verifying remote information of a telemetry and control device according to claim 2, characterized in that, The structured feature matrix and the corresponding anomaly score for each anomaly score greater than a preset threshold are fed as additional features into the XGBoost model to obtain the corresponding anomaly categories, including: Samples containing 8 types of anomaly labels are fed into the XGBoost model to train the XGBoost model, and the Huber loss function is used to optimize the XGBoost model. After training is completed, the structured feature matrix with anomaly scores greater than a preset threshold and the corresponding anomaly scores are sent as samples to be verified into the XGBoost model. The XGBoost model outputs eight unnormalized raw scores for the sample to be verified, which correspond to the raw matching degree of the eight anomalies respectively. The softmax function transforms the eight raw scores into a probability distribution using formula (6) to obtain the preliminary probability that each sample belongs to each type of anomaly: Official (6), in, This represents the initial probability that the sample to be verified belongs to the k-th type of anomaly. This represents the original score of the sample to be verified corresponding to the k-th type of anomaly. Indicates the category of the exception. Indicates the first The raw score of the exception class; The category with the highest initial probability and greater than the preset threshold is selected as the predicted anomaly type of the sample to be verified.

9. The method for verifying remote information of a telemetry and control device according to claim 8, characterized in that, The XGBoost model is optimized using the Huber loss function, including: The XGBoost model is optimized using the Huber loss function shown in Equation (7): Official (7), in, The Huber loss value represents the magnitude of the loss corresponding to the model's prediction error, and is the core objective of optimization. This represents the model prediction error. Indicates the error threshold; A short address conflict penalty factor is added to formula (7) to construct the Huber loss function: Official (8), in, This represents the weighted Huber loss value, which amplifies the loss due to key anomalies through a penalty factor, allowing the model to prioritize optimization. The penalty factor is 2 when the sample belongs to the short address duplicate mapping anomaly, and 1 when it belongs to other anomalies.

10. The method for verifying remote information of a telemetry and control device according to claim 2, characterized in that, Based on the corresponding anomaly category, the structured feature matrix corresponding to the anomaly category is fed into the category tracing model to obtain the anomaly root cause in the structured feature matrix, including: Obtain the structured feature matrix and feed it into the Tree SHAP interpreter to calculate the contribution of the features in the structured feature matrix to the current anomaly classification result using formula (9): Official (9), in, Indicates the first The output of the anomaly classification prediction for sample v, i.e., the contribution, Indicates the baseline value. Indicates the first Each feature for the sample The SHAP value is positive, indicating that the feature promotes the classification of the sample as an anomaly, and negative, indicating that the feature inhibits the classification of anomalies. The larger the absolute value, the stronger the contribution. The contribution of each feature is normalized to obtain a normalized contribution score, and the features in the structured feature matrix are sorted in descending order based on the normalized contribution score. Features with normalized contribution scores ranked in the top preset positions, and whose SHAP values ​​are positive and whose absolute values ​​exceed preset thresholds are used as the root causes of anomalies.

Images