An edge resource perception gate and double threshold hysteresis control-based low-voltage power distribution network time series anomaly detection method

Abstract

This invention discloses a time-series anomaly detection method for low-voltage distribution networks based on edge resource-aware gating and dual-threshold hysteresis control. The method includes acquiring multivariate time-series data of the low-voltage distribution network and completing preprocessing and time-slice construction; constructing a multi-scale collaborative attention model based on the time-slice sequence, extracting local time features, downscaling features, and conditionally triggered cross-variable collaborative features; constructing a resource state vector and calculating resource fitness; determining the current model structure state using a dual-threshold hysteresis rule and generating corresponding feature branch gating vectors; performing forward inference on the model to obtain a reconstructed time-slice sequence; calculating anomaly scores based on the reconstruction results, and determining anomalies based on the dual-threshold hysteresis rule to obtain the detection results. This invention can more effectively distinguish typical abnormal operating conditions and, by combining time-slice-level anomaly scoring with time-point aggregation output, improves the accuracy of anomaly detection results and the ability to locate the time of anomaly occurrence.

Description

Technical Field

[0001] This invention relates to the field of low-voltage distribution network operation status monitoring and edge intelligent analysis technology, and in particular to a method for detecting time series anomalies in low-voltage distribution networks based on edge resource perception gating and dual-threshold hysteresis control. Background Technology

[0002] With the widespread deployment of digital power distribution equipment and smart metering terminals in low-voltage distribution networks, transformer substations and user sides continuously generate high-frequency, multi-variable operational measurement data, including three-phase voltage, current, active and reactive power, power factor, and harmonic indices. This data reflects the dynamic changes in the operating status of the low-voltage distribution network, characterized by significant three-phase imbalance, diverse time scales, frequent abrupt changes, and high noise levels. Real-time and reliable anomaly detection is crucial for ensuring power quality, identifying abnormal operating conditions, and preventing equipment failures. However, a large number of detection tasks in low-voltage distribution networks need to be completed on edge devices such as concentrators and smart meter acquisition units. These devices have limited computing resources and are power-sensitive, placing higher demands on the real-time performance, lightweight design, and stability of the models. Therefore, constructing a time-series anomaly detection method that can operate efficiently at the edge and adapt to the multi-variable coupling characteristics of low-voltage distribution networks is particularly important.

[0003] Existing research commonly employs deep learning models to extract temporal features, including Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), Long Short-Term Memory Networks (LSTMs), and Gated Recurrent Units (GRUs). These methods model the dynamic patterns of measurement sequences such as voltage and current through nonlinear mapping and hierarchical structures. With the development of attention mechanisms, time series modeling has gradually evolved towards capturing global dependencies and multi-scale feature representations of long sequences. Transformer-based attention models have been applied to anomaly detection tasks, capable of characterizing the correlations between different operational quantities and extracting operational features across time scales in multivariate power time series. To further enhance expressive power, related research has introduced structural improvements such as multi-scale attention modeling, patch-based modeling, and hierarchical feature fusion to simultaneously consider local perturbations and overall trends. In addition, some studies have reduced model size through feature selection, model pruning, and quantization compression to enhance its deployment flexibility in edge environments.

[0004] However, existing methods still have the following shortcomings when applied to multivariate time-series anomaly detection scenarios at the edge of low-voltage distribution networks: On the one hand, although multi-scale attention models can improve the ability to express time-series features, their network structures are usually quite complex, with a large number of parameters and computational overhead. When deployed on resource-constrained devices such as concentrators and edge gateways, it is difficult to simultaneously meet the requirements of real-time inference and lightweight operation. On the other hand, most existing anomaly detection methods adopt fixed-structure models. Even when lightweight strategies such as model pruning and feature selection are introduced, they mostly focus on offline compression and lack an online mechanism for dynamically adjusting the model structure based on the real-time resource status of the device.

[0005] When the computational load, memory usage, or inference latency of edge devices fluctuates, directly simplifying or switching the model structure can easily lead to changes in feature extraction capabilities and fluctuations in abnormal score distribution, resulting in unstable detection results, increased false alarm rates, or exacerbated alarm jitter. Existing technologies typically separate the temporal feature modeling process from the resource adjustment process, and have not yet formed a collaborative mechanism that combines resource status awareness, structural gating adjustment, and stable switching control. Therefore, it is difficult to balance detection accuracy, real-time performance, and alarm stability in low-voltage distribution network edge deployment scenarios.

[0006] Therefore, there is an urgent need for a time-series anomaly detection method for edge devices in low-voltage distribution networks. While retaining the ability to extract multi-scale time-series features, this method introduces a resource-aware gating and dual-threshold hysteresis switching mechanism to adaptively adjust the model structure according to the device resource status and suppress the fluctuation of detection results caused by structure switching, thereby improving the engineering applicability and stability of the anomaly detection method in edge scenarios. Summary of the Invention

[0007] Purpose of the invention: The purpose of this invention is to provide a method for detecting time series anomalies in low-voltage distribution networks based on edge resource sensing gating and dual-threshold hysteresis control.

[0008] Technical solution: The low-voltage distribution network time series anomaly detection method based on edge resource sensing gating and dual-threshold hysteresis control described in this invention includes the following steps:

[0009] S1: Acquire multivariate time-series data of low-voltage distribution network and complete preprocessing and time slice construction;

[0010] S2: Construct a multi-scale collaborative attention model based on time-slice sequences to extract local temporal features, downscaling features, and conditionally triggered cross-variable collaborative features;

[0011] S3: During the model inference process, the CPU utilization, memory utilization and single forward inference latency of the edge device are obtained in real time, a resource state vector is constructed and the resource fitness is calculated; based on the relationship between the resource fitness and the preset upper and lower thresholds, the current model structure state is determined by the double threshold hysteresis rule, and the corresponding feature branch gating vector is generated.

[0012] S4: Perform forward inference under the current model structure state, and fuse the local temporal features and downscaling features activated by the feature branch gating vector; for cross-variable collaborative features, participate in the fusion only when the corresponding branch is activated by the gating vector and the current time slice meets the local perturbation triggering condition; generate the reconstructed time slice sequence corresponding to the input time slice based on the fusion result;

[0013] S5: Calculate the anomaly score based on the reconstruction results, and determine the anomaly based on the double threshold hysteresis rule to obtain the detection results.

[0014] Further, step S1 includes:

[0015] Continuous operation monitoring data is acquired from equipment on the low-voltage distribution network side or user-side acquisition terminals. The measured variables include three-phase voltage, three-phase current, and active / reactive power, forming a multivariate measurement time series.

[0016]

[0017] In the formula, Indicates the total number of sampling times. Indicates time The total variable measurement vector; Represents a multivariate measurement time series;

[0018] Let the first Each measured variable at time... The value is The standardized result is:

[0019]

[0020] In the formula, and The first The mean and standard deviation of each measurement variable over the normal operating data segment; after standardization, the standardized multivariate time series is obtained:

[0021]

[0022] In the formula, Indicates time Standardized measurement vector; Represents standardized multivariate time series; uses a sliding window approach to represent standardized multivariate time series. Perform time slice construction; set the window length as... The sliding step size is Then the first Each time slice is represented as:

[0023]

[0024] In the formula, For the first Number of time slices This yields the time-slice sequence. This data is then used as input to a subsequent multi-scale collaborative attention model to characterize the local dynamic features of multivariate operating data in low-voltage distribution networks within a continuous time window.

[0025] Further, step S2 includes:

[0026] S2.1: A local temporal attention mechanism is introduced within each time slice, assigning adaptive weights to different time positions within the slice in the time dimension to obtain the local encoding features of the time slice. According to the local coding features Calculate the local disturbance intensity index ;

[0027] S2.2: Introducing a time-slice downscaling fusion strategy, this approach compresses and aggregates multiple adjacent time slices over a longer time span to extract long-term trend information across time slices, thus obtaining downscaling features. ;

[0028] S2.3: Based on the extraction of local features and downscaling features, a conditionally triggered cross-variable collaborative modeling method is introduced, where the local perturbation intensity index of the time slice... Greater than or equal to the preset disturbance threshold When the current time slice is deemed to meet the triggering conditions for enabling cross-variable collaborative modeling, the dependencies and collaborative change patterns among the measured variables are modeled to obtain cross-variable collaborative features. When the local disturbance intensity index of the time slice Less than the preset disturbance threshold If the current time slice is deemed not to meet the triggering conditions for cross-variable collaborative modeling, then the cross-variable collaborative branch corresponding to the current time slice remains in an untriggered state.

[0029] Furthermore, in step S2.3, a preset disturbance threshold is set. Take local disturbance intensity index The preset high quantile, or determined according to the preset perturbation threshold mean and standard deviation, that is:

[0030]

[0031] In the formula, and These represent the local disturbance intensity indices. The mean and standard deviation in the normal operating data segment. This is the threshold adjustment coefficient.

[0032] Further, step S3, which involves constructing a resource state vector and calculating resource fitness, includes:

[0033] Assume the first The resource amounts collected during each inference iteration, namely CPU utilization, memory utilization, and model latency per forward inference iteration, are respectively: , and The resource quantity adopts a length of The resource statistics are smoothed by using a sliding window:

[0034]

[0035] In the formula, To determine the smoothing window length for resource status, the smoothed CPU utilization, memory utilization, and model single forward inference latency are normalized by comparing them to the corresponding resource budget caps, resulting in normalized resource components. , and :

[0036]

[0037] In the formula, , and These represent the upper limits of CPU utilization budget, memory utilization budget, and model single forward inference latency budget, respectively; when the normalization result exceeds 1, it is truncated to 1; construct the... Resource state vector corresponding to the next inference step:

[0038]

[0039] Based on the resource state vector, calculate the first... Resource fitness score corresponding to the next reasoning step :

[0040]

[0041] In the formula, , and , which are weighting coefficients used to characterize the importance of different resource indicators.

[0042] Further, step S3, which involves determining the current model structure state and generating the corresponding feature branch gating vector, includes:

[0043] Based on resource fitness score With preset upper threshold Lower threshold The relationship determines the current model structure state:

[0044] when When the current edge device is determined to be in a high-resource state, a more complete multi-scale collaborative attention structure can be enabled.

[0045] when When the current edge device is determined to be in a low resource state, the model structure is simplified.

[0046] when At the same time, the current model structure state remains unchanged;

[0047] When the model structure state changes, the current gating vector remains unchanged within the preset continuous inference cycle;

[0048] Based on the determined current model structure state, generate the first... Feature branch gating vector corresponding to each inference step:

[0049]

[0050] In the formula, and These are used to control the local temporal feature branch, the downscaling feature branch, and the intervariate collaborative feature branch respectively in the 1st... The activation status during the time slice encoding process, with a value of 1 indicating that the corresponding branch is activated and a value of 0 indicating that the corresponding branch is suppressed; Indicates the first Feature branch gating vectors corresponding to each inference step;

[0051] When the model structure is in a high-resource state, take When the model structure state is in the medium resource state, take... When the model structure is in a low-resource state, take... .

[0052] Further, step S4 includes:

[0053] Under the current model structure determined in step S3, forward inference is performed on the preprocessed low-voltage distribution network time-slice sequence. The low-voltage distribution network time-slice sequence is sequentially input into the gated and adjusted multi-scale collaborative attention model. For the first... Each time slice, based on the current gate vector and local disturbance trigger flags The feature extraction branches involved in the time slice encoding are determined, and only the outputs of the activated branches are fused to obtain the first... Multi-scale coding representation of time slices ;

[0054] The multi-scale coding representation satisfies:

[0055]

[0056] In the formula, , and These represent local temporal features, downscaling features, and cross-variable collaborative features, respectively. , and These represent the corresponding feature branches at the th... Gating states during a time-slice encoding process; This indicates the local perturbation triggering flag for cross-variable cooperative branching, thereby forming a multi-scale feature sequence. ;

[0057] The model output layer generates a reconstruction result corresponding to the input time slice based on the encoded representation formed under the current model structure state. For the th time slice... Each time slice yields a reconstructed vector at the output layer. And transpose it to a reconstructed time slice with the same dimension as the input time slice. :

[0058]

[0059] In the formula, and For output layer parameters, For the first The reconstruction results of each time slice.

[0060] Furthermore, the forward reasoning process also includes extracting the corresponding attention weight matrix from the attention branches activated in the current gating state as auxiliary information for anomaly analysis, wherein the attention matrix corresponding to the local temporal attention module... Used to characterize the importance distribution among different sampling moments within a time slice; attention matrix corresponding to the cross-variable collaborative attention module. It is used to characterize the coupling relationship and cooperative change pattern between different electrical measurement variables.

[0061] Further, step S5 includes:

[0062] Based on the reconstructed time slice sequence output in step S4 With the corresponding input time slice sequence Calculate the residual matrix for each time slice:

[0063]

[0064] in, , Indicates the number of monitored variables. Indicates the time slice length; based on the reconstructed residual matrix The residual energy, constructing the first Time-slice-level anomaly rating for each time slice:

[0065]

[0066] Let the sliding step size be... , No. The time interval covered by each time slice is denoted as:

[0067]

[0068] For any given moment Let the set of time slice indices covering this moment be:

[0069]

[0070] The time point score at that moment is defined as follows:

[0071]

[0072] Based on the statistical results of time-point scores in normal operation data segments or offline calibration data segments, a dual threshold for anomaly detection is determined. and ,in:

[0073]

[0074] And satisfy ;

[0075] In the formula, and These represent the mean and standard deviation of the scores for the corresponding time points in the normal operation data, respectively. and These are the high threshold adjustment coefficient and the low threshold adjustment coefficient, respectively.

[0076] For each moment abnormal state The determination is made using a dual-threshold hysteresis method:

[0077] Scoring at the point in time Greater than or equal to the high threshold When this happens, the current moment will be considered abnormal;

[0078] Scoring at the point in time Less than or equal to the low threshold At that time, the current moment will be judged as normal;

[0079] When the score at a given time point is between the low and high thresholds, the judgment state of the previous time point remains unchanged.

[0080] This yields the final anomaly detection result sequence:

[0081]

[0082] Through the above-mentioned abnormal scoring, time axis aggregation, and dual-threshold hysteresis judgment process based on the reconstructed residual, when the score is close to the judgment boundary, the current output state is maintained according to the judgment result of the previous moment, thus suppressing repeated alarm switching caused by fluctuations near the threshold.

[0083] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages:

[0084] (1) This invention collects the CPU utilization rate, memory utilization rate and single forward inference latency of edge devices in real time during the model inference process, constructs a resource state vector and calculates the resource fitness, and further combines the double threshold hysteresis rule and the hold period to stabilize the model structure state, thereby suppressing the frequent start and stop of the feature extraction module and the frequent switching of the model structure under the condition of edge device resource fluctuation, and improving the operational stability, real-time performance and deployment adaptability of the anomaly detection process;

[0085] (2) This invention constructs a resource-aware structure gating mechanism for edge devices, and generates feature branch gating signals based on resource status information such as CPU utilization, memory utilization and model inference latency. These signals are used to control the start and stop of local time feature extraction branches, downscaling feature extraction branches and cross-variable correlation feature extraction branches. This enables the model to adaptively adjust the internal feature encoding path according to the resource status of the edge device. Under resource-constrained conditions, key feature extraction branches that are sensitive to abnormal disturbances are retained first, thereby reducing computational overhead and inference latency while maintaining anomaly detection accuracy.

[0086] (3) By jointly modeling the local short-term disturbances, slow change trends across time scales and coupling relationships between variables in the multivariate time series of low-voltage distribution networks, this invention can more effectively distinguish typical abnormal operating conditions such as over-limit voltage at the end, three-phase imbalance, load mutation and abnormal power fluctuation. Combined with time slice-level anomaly scoring and time point aggregation output, it can improve the accuracy of anomaly detection results and the ability to locate the time of anomaly occurrence. Attached Figure Description

[0087] Figure 1 A flowchart of a low-voltage distribution network time series anomaly detection method based on edge resource sensing gating and dual threshold hysteresis control provided by the present invention;

[0088] Figure 2 This is a schematic diagram of multivariate time series data preprocessing and time slice construction in an embodiment of the present invention;

[0089] Figure 3 This is a structural diagram of the conditional co-coding model under resource constraints in an embodiment of the present invention;

[0090] Figure 4 This is a schematic diagram of resource status awareness gating and model structure switching in an embodiment of the present invention. Detailed Implementation

[0091] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0092] This embodiment takes a low-voltage distribution network edge monitoring scenario as an example. The multivariate time-series data collected by the edge monitoring terminal includes three-phase A-phase voltage, B-phase voltage, C-phase voltage, A-phase current, B-phase current, C-phase current, active power, and reactive power, totaling eight monitoring variables. During operation, the CPU utilization, memory utilization, and single forward inference latency of the edge device fluctuate with changes in the operating load. Therefore, this embodiment introduces resource status awareness, dual-threshold hysteresis, and gating structure switching mechanisms on the basis of the multi-scale time-series anomaly detection backbone to achieve stable anomaly detection under resource fluctuation conditions.

[0093] like Figure 1 As shown in the figure, the low-voltage distribution network time series anomaly detection method based on edge resource sensing gating and dual-threshold hysteresis control provided by the present invention includes the following steps:

[0094] S1: Acquire multivariate time-series data of low-voltage distribution network and complete preprocessing and time slice construction;

[0095] S2: Construct a multi-scale collaborative attention model based on time-slice sequences to extract local temporal features, downscaling features, and conditionally triggered cross-variable collaborative features;

[0096] S3: During the model inference process, acquire edge device resource status information, construct a resource status vector, and generate a gating signal for adjusting the model structure based on the resource status vector; combine the dual threshold hysteresis rule to stabilize the gating signal and determine the current model structure state to reduce frequent structure switching caused by resource fluctuations;

[0097] S4: Execute forward inference of the multi-scale collaborative attention model under the current model structure state, perform feature fusion and reconstruction output on at least one activated feature extraction branch, and obtain multi-scale features and reconstruction results for anomaly detection;

[0098] S5: Calculate the anomaly score based on the reasoning results, and determine the anomaly based on the double threshold hysteresis rule to obtain the detection results.

[0099] Step S1 is used to process the raw monitoring data of the low-voltage distribution network into a time-slice sequence that can be directly input into the subsequent model.

[0100] Specifically, firstly, continuously sampled multivariate time-series data is acquired from the edge monitoring terminal of the low-voltage distribution network. Let the original time series be:

[0101]

[0102] In the formula, Indicates the total number of sampling times; at any sampling time Measurement vector ,Right now:

[0103]

[0104] In the formula, Representing time respectively Phase A voltage, Phase B voltage, Phase C voltage, Representing time respectively The A-phase current, B-phase current, and C-phase current, Representing time respectively The active power and reactive power.

[0105] In this embodiment, the sampling period is fixed at 1 minute. After acquiring the raw data, missing value processing and outlier correction are performed first. For missing points, linear interpolation is used to fill in the missing values; for outliers that significantly exceed the normal operating range of the distribution network, the mean of adjacent time points is used for correction. After completing the missing value processing and outlier correction, each monitored variable is standardized. Let the first... Each measured variable at time... The value is The standardized result is:

[0106]

[0107] In the formula, and The first The mean and standard deviation of each measurement variable over the normal operating data segment. After standardization, the standardized multivariate time series is obtained:

[0108]

[0109] In the formula, Indicates time The standardized measurement vector.

[0110] Then, a sliding window approach is used to analyze the standardized multivariate time series. Perform time slice construction. Assume the time slice length is... The sliding step size is Then the first Each time slice is represented as:

[0111]

[0112] In the formula, This represents a time-slice matrix consisting of 8 monitored variables at 48 consecutive sampling times. The time-slice sequence is composed of all the time slices.

[0113]

[0114] In the formula, the total number of time slices for:

[0115]

[0116] like Figure 2 As shown, the time-slice sequence is obtained by dividing normalized multivariate time-series data through a sliding window. There is an overlapping interval between adjacent time slices, with an overlap length of 40 sampling points. This construction method ensures that short-term abnormal fluctuations are continuously covered between adjacent time slices and provides a basis for subsequently mapping time-slice-level anomaly scores back to the original time axis.

[0117] After constructing the time slices, the time slice sequence is divided into a training set, a validation set, and a test set, with a fixed ratio of 7:1:2. The training set is used for learning model parameters, the validation set is used to determine threshold parameters and gating-related parameters, and the test set is used to verify anomaly detection results.

[0118] In step S2, the time slice sequence obtained in step S1 is used as a basis. A multi-scale collaborative attention model is constructed to extract local temporal features, downscaling features, and conditionally triggered cross-variable collaborative features for each time slice.

[0119] First, to address short-term anomalous perturbations within a time slice, a local temporal attention mechanism is employed for each individual time slice. Feature extraction is performed in the time dimension. Let the first... Each time slice is represented as:

[0120]

[0121] In the formula, Indicates the first Within the time frame, the first The 8-dimensional measurement vector corresponding to each sampling time point. (Time slice) After inputting the local temporal attention module, the query matrix, key matrix, and value matrix are first obtained through linear mapping:

[0122]

[0123] In the formula, , , Let represent the linear mapping parameter matrices of the local temporal attention module. Further calculation of the temporal attention matrix:

[0124]

[0125] In the formula, , The feature dimension representing local temporal attention. In this embodiment, Then, the value matrix is ​​weighted using the aforementioned time-dimensional attention matrix to obtain the first... Local temporal characteristics of each time slice:

[0126]

[0127] In the formula, The local temporal features are used to characterize the importance distribution among different sampling moments within a time slice and the transient change patterns associated with anomalous perturbations.

[0128] Based on the local time features Calculate the local disturbance intensity index This is used to characterize the significance of anomalous related fluctuations within the current time slice. In this embodiment, the local disturbance intensity index is defined as:

[0129]

[0130] In the formula, Representing local time features In the The column vector corresponding to each sampling time point This represents the L2 norm. The larger the local disturbance intensity index, the more pronounced the local fluctuations within the current time slice.

[0131] Secondly, considering the slow-changing characteristics caused by voltage offset accumulation, load cycle variations, and distributed power source integration, a downscaling aggregation method is used to extract long-term trend information. Specifically, based on the... A time slice Centered on a time slice, it is combined with adjacent time slices, and a slow-change trend representation is obtained through time-dimensional downsampling. In this embodiment, three consecutive adjacent time slices are taken as downscaling aggregation units, namely:

[0132]

[0133] In the formula, when or In this case, missing parts are filled in using boundary copying. Then, average pooling is performed on the aggregation unit in the time dimension to obtain a downscaled representation:

[0134]

[0135] In the formula, This represents the time-dimensional average pooling operation. In this embodiment, the time length after pooling is fixed at 24. Further, the 1st... Downscaling characteristics of each time slice:

[0136]

[0137] In the formula, and Let represent the linear mapping parameters of the downscaling branch, respectively. The downscaling feature is used to characterize slow change trends across time slices.

[0138] Finally, to address the strong coupling relationships among multivariate measurements in low-voltage distribution networks, a condition-triggered cross-variable collaborative modeling branch is constructed. This branch is not executed fixedly for all time slices, but rather first based on the local disturbance intensity index. Determine if the current time slice meets the triggering conditions. Assume a preset local disturbance triggering threshold of... Then the first The trigger flag for each time slice is defined as:

[0139]

[0140] In the formula, This indicates that the current time slice meets the triggering conditions for cross-variable collaborative modeling. This indicates that the current time slice does not meet the triggering conditions. In this embodiment, the threshold... The local disturbance intensity index is determined based on the statistical results of the normal operation data, and is specifically defined as follows:

[0141]

[0142] In the formula, and These represent the mean and standard deviation of the local disturbance intensity index in the normal operation data segment, respectively. The threshold adjustment coefficient is taken as [value missing] in this embodiment. .

[0143] when At that time, for the first Perform cross-variable collaborative modeling across time slices. Specifically, time slices... After converting to a variable-dimensional representation, construct the query matrix, key matrix, and value matrix respectively:

[0144]

[0145] In the formula, , and These represent the parameter matrices for cross-variable collaborative branches. Further calculation of the variable-dimensional attention matrix:

[0146]

[0147] In the formula, , The feature dimension representing cross-variable collaborative attention, in this embodiment The cross-variable collaborative features are obtained by weighting the value matrix based on the variable-dimensional attention matrix:

[0148]

[0149] In the formula, The intervariable collaborative features are used to characterize the intervariable dependencies such as three-phase imbalance, voltage-current-power coupling, and phase-to-phase current correlation.

[0150] when At this time, cross-variable collaborative modeling is not performed, and the cross-variable collaborative branch corresponding to the current time slice remains untriggered. It should be noted that in this step, It is only used to characterize whether the current time slice has the triggering conditions for cross-variable collaborative modeling; whether the cross-variable collaborative features actually participate in the encoding of the current time slice is determined by the gating vector generated in step S3 in step S4.

[0151] In step S3, during model inference, edge device resource state information is acquired, a resource state vector is constructed, and a gating signal for adjusting the model structure is generated based on the resource state vector. The gating signal is then stabilized using a dual-threshold hysteresis rule to determine the current model structure state, thereby reducing frequent structure switching caused by resource fluctuations. Figure 3 As shown.

[0152] Specifically, in each time slice During forward inference, the CPU utilization, memory utilization, and single forward inference latency of the edge device are collected simultaneously and recorded as follows:

[0153]

[0154] In the formula, Indicates the first CPU utilization of edge devices during inference Indicates the first Memory usage of edge devices during inference Indicates the first Single forward inference latency of edge devices during each inference iteration.

[0155] To mitigate the interference of instantaneous resource fluctuations on model structure switching, a sliding window approach is used to smooth the resource state variables. Let the length of the resource smoothing window be... Then the first The smoothed resource state quantities corresponding to each inference step are as follows:

[0156]

[0157] when When calculating the mean, the resource state quantities corresponding to the existing number of inference iterations are used.

[0158] To unify resource state quantities with different dimensions onto the same evaluation scale, normalization is performed based on the upper limits of CPU utilization budget, memory utilization budget, and inference latency budget. Let the three budget limits be: , , Then the normalized resource component is defined as:

[0159]

[0160] In the formula, , and They represent the first The CPU resource pressure, memory resource pressure, and latency resource pressure corresponding to each inference step. For example... Figure 4As shown, to facilitate subsequent unified evaluation, a resource state vector is constructed:

[0161]

[0162] In this embodiment, the upper limit of CPU utilization budget is fixed at 0.85, the upper limit of memory utilization budget is fixed at 0.80, and the upper limit of inference latency budget is fixed at 0.20 seconds.

[0163] Obtaining the resource state vector Then, resource fitness is further calculated. This is used to characterize the current edge device's capacity to support multi-branch cooperative coding structures. Resource fitness is defined as:

[0164]

[0165] In the formula, , and Let these represent the weighting coefficients corresponding to CPU resource pressure, memory resource pressure, and latency resource pressure, respectively, and satisfy the following conditions:

[0166]

[0167] In this embodiment, take , , Therefore, resource adaptability The value range of is [0,1], and A larger value indicates that the current edge device has more abundant resources. The smaller the value, the more strained the current edge device resources are.

[0168] To avoid frequent model structure switching caused by small fluctuations in resource fitness around a threshold, this embodiment employs a dual-threshold hysteresis mechanism combined with a hold period to stabilize the gating state. Let the high resource threshold be... Low resource threshold is The maintenance period is ,in:

[0169]

[0170] Specifically, when resource fitness And continuously satisfy During the next inference, it is determined that the current model structure state switches to a high-resource state; when the resource fitness And continuously satisfy During the next inference, the current model structure state is determined to switch to a low-resource state; when the resource fitness is satisfied... At this time, the model structure state remains unchanged from the previous time step. For the initial inference time step, the default model structure state is set to the medium resource state.

[0171] After determining the current model structure state, a gating vector corresponding to the structure state is generated:

[0172]

[0173] In the formula, , and They represent the first The local time branch gating value, downscaling branch gating value, and cross-variable collaborative branch gating value are corresponding to each time slice; all the gating values ​​are either 0 or 1.

[0174] The correspondence between the gating vectors and the model structure states is set as follows:

[0175] When the model structure is in a high-resource state, take: This indicates that the local time disturbance extraction branch, the slow change trend extraction branch, and the cross-variable collaborative modeling branch all participate in the current time slice encoding;

[0176] When the model structure is in a medium resource state, take: This indicates that the local time disturbance extraction branch and the slow change trend extraction branch participate in the current time slice coding, while the cross-variable collaborative modeling branch does not participate in the current time slice coding;

[0177] When the model structure is in a low-resource state, take: This indicates that only the local time disturbance extraction branch is retained for the current time slice coding, while the slow change trend extraction branch and the cross-variable collaborative modeling branch are not included in the current time slice coding.

[0178] In step S4, forward inference of the multi-scale collaborative attention model is performed under the current model structure state. Feature fusion and reconstruction output are performed on at least one activated feature extraction branch to obtain multi-scale features and reconstruction results for anomaly detection.

[0179] First, gating is performed on each candidate feature branch based on the gating vector. For the local time branch, the gating output is defined as:

[0180]

[0181] For the downscaling branch, its gated output is defined as:

[0182]

[0183] For the cross-variable collaborative branch, since this branch is subject to resource state gating as well as the local disturbance trigger flag in step S2, Constraints, therefore its gated output is defined as:

[0184]

[0185] In the formula, when and When this condition is met, it indicates that the current time slice satisfies both the resource state allowance condition and the local perturbation trigger condition; in this case, the cross-variable collaborative feature participates in the encoding of the current time slice. or At that time, cross-variable collaborative branches do not participate in the current time slice coding.

[0186] Because the feature dimensions and time dimension of local temporal features, downscaling features, and intervariate collaborative features are not entirely consistent, a unified dimension mapping is performed on the outputs of each branch before fusion. Specifically, for... , and Perform linear transformations and time-dimensional resampling respectively to uniformly map them to an intermediate representation of dimension 32×48, denoted as follows:

[0187]

[0188] in, The length was restored from 24 to 48 by time-dimensional upsampling. After variable dimension mapping and time dimension expansion, it is transformed into a feature representation consistent with other branches.

[0189] After completing the unified dimension mapping, the three gated branch features are fused to obtain the first... Fusion encoding of time slices:

[0190]

[0191] In this embodiment, the fusion function This is achieved using a concatenated linear mapping approach. Specifically, the three branch features are first concatenated along the feature dimension to obtain:

[0192]

[0193] Then, the fused encoding is obtained through the fusion mapping layer:

[0194]

[0195] In the formula, and These represent the weight matrix and bias term of the fusion mapping layer, respectively, and the fusion encoding. .

[0196] When a branch is not activated, the corresponding gating output is a zero matrix, and therefore does not contribute to the current time-slice fusion coding during the splicing and fusion process. In this way, the branch structure participating in coding can be dynamically switched based on the current resource status and local perturbation conditions without changing the overall coding output interface.

[0197] After obtaining the fusion encoding Then, the output layer is reconstructed to generate the first... The reconstruction results for each time slice. Specifically, let the parameters of the reconstruction mapping layer be... and Then the first The reconstruction vector corresponding to each time slice is represented as follows:

[0198]

[0199] The reconstructed vector is then rearranged into a reconstructed time slice with the same dimension as the original time slice:

[0200]

[0201] The reconstruction results corresponding to all time slices can form a reconstruction time slice sequence:

[0202]

[0203] In the formula, This indicates that the model is in the current gating structure state for the first... Input time slice The reconstructed output.

[0204] In step S5, an anomaly score is calculated based on the reasoning results, and anomaly determination is performed based on the dual-threshold hysteresis rule to obtain the detection results.

[0205] Specifically, based on the reconstructed time slice sequence output in step S4 , and the corresponding input time slice sequence Calculate the reconstructed residual matrix for each time slice:

[0206]

[0207] In the formula, Indicates the first The reconstruction error at 8 variables and 48 sampling times in each time slice. The reconstruction residual matrix is ​​obtained. Then, a time-slice-level anomaly score is constructed based on residual energy. The anomaly score for each time slice is defined as follows:

[0208]

[0209] The larger the value, the greater the reconstruction error of that time slice, and the higher the probability of an anomaly.

[0210] Since the time-slice sequence is constructed using a sliding window method in step S1, there are overlapping intervals between adjacent time slices. Therefore, the time-slice-level anomaly scores need to be further mapped back to the original time axis to obtain the anomaly scores at each sampling moment. Let the window length be... Sliding step size Then the first The time intervals covered by each time slice in the original time series are denoted as:

[0211]

[0212] For any original sampling time Let the set of time slice indices covering this moment be:

[0213]

[0214] The time point score corresponding to that moment is defined as:

[0215]

[0216] In the formula, Indicates the coverage time The number of time slices. This allows for a smooth mapping of time-slice-level anomaly scores to each sampling moment on the original time axis, resulting in a time-point score sequence:

[0217]

[0218] Based on the statistical results of time-point scores in normal operation data segments or offline calibration data segments, a dual threshold for anomaly detection is determined. and ,in:

[0219]

[0220] And satisfy In the formula, and These represent the mean and standard deviation of the scores for the corresponding time points in the normal operation data, respectively. and These are the high threshold adjustment coefficient and the low threshold adjustment coefficient, respectively. In this embodiment, we take... , .

[0221] Let the first The abnormal state at each sampling time is , ,in Indicates an abnormal state. Indicating the normal state, then the first... The state update rule at any given time is:

[0222]

[0223] Among them, when the time point score Not less than the high threshold When the current moment is considered abnormal, a time point score will be applied. Not greater than the low threshold When the score at a given time point falls between the low and high thresholds, the previous time point's judgment is maintained. This yields the final anomaly detection result sequence:

[0224]

[0225] To verify the effectiveness of this invention, anomaly detection experiments were conducted on an existing dataset. In this embodiment, the proposed model architecture was implemented using the PyTorch framework. The model's training environment and hyperparameter settings are as follows:

[0226] Training environment: GPU was an NVIDIA GeForce RTX 4060 graphics card with 8GB of VRAM; CPU was an Intel Core i7-13700; RAM was 32GB; training batch size was set to 64; training epochs were set to 100; initial learning rate was set to 0.01; the optimizer used was the Adam optimizer; time slice length was set to 48; and sliding step size was set to 8. Four typical anomaly detection methods were selected as comparison models, and accuracy (Pre), recall (Rec), and F1 score were used as evaluation metrics to compare the performance of the method of this invention. The results are shown in Table 1.

[0227] Table 1 Model Performance Comparison Table

[0228] Model Pre Rec F1 PCA 0.825 0.706 0.760 LSTM-AE 0.853 0.771 0.810 USAD 0.868 0.792 0.828 TranAD 0.894 0.823 0.857 This invention 0.913 0.853 0.882

[0229] As can be seen from Table 1, compared with the comparison methods such as PCA, LSTM-AE, USAD and TranAD, the method of the present invention has achieved better results in terms of accuracy, recall and F1 score.

[0230] To further verify the effectiveness and stability of the method of this invention, this embodiment, in addition to setting a typical anomaly detection model as a control group, also sets up different resource pressure scenarios and ablation experiments. The control group includes a fixed-structure Transformer, a static pruning-only model, a dynamic threshold-only model, and a local attention-only model; the resource scenarios include low resource pressure, medium resource pressure, and high resource pressure scenarios; the ablation experiments include removing dual-threshold hysteresis, removing cross-variable collaborative branches, removing downscaling branches, and removing resource state-aware gating. Evaluation metrics include F1 score, AUC, average inference latency, and alarm jitter rate.

[0231] Table 2. Results of the control group experiment

[0232] Model F1 AUC Average inference latency / ms Alarm jitter rate / % Fixed structure Transformer 0.846 0.904 41.8 9.7 Static pruning model only 0.821 0.887 32.5 11.4 Dynamic threshold determination model only 0.854 0.909 40.9 7.1 Local attention model only 0.803 0.872 24.6 12.8 This invention 0.882 0.931 30.8 4.3

[0233] As shown in Table 2, the method of this invention outperforms all control groups in terms of F1 score, AUC, and alarm jitter rate. While the fixed-structure Transformer has good temporal modeling capabilities, its fixed model structure makes it difficult to adapt to changes in edge resource states, resulting in high inference latency and a large alarm jitter rate. Only the static pruning model reduces inference latency, but its detection performance decreases due to its long-term fixed structure. Only the dynamic threshold determination model improves alarm stability, but it cannot adjust the internal encoding structure according to resource states. Only the local attention model has the weakest overall detection performance due to the lack of slow-change trend modeling and cross-variable collaborative modeling. In contrast, the method of this invention effectively reduces inference latency and suppresses alarm jitter while maintaining high detection accuracy.

[0234] Table 3 Experimental results under different resource pressure scenarios

[0235] Scene method F1 AUC Average inference latency / ms Alarm jitter rate / % Low resource pressure Transformer 0.861 0.916 38.4 8.1 Low resource pressure This invention 0.885 0.933 29.1 4.1 resource pressure Transformer 0.848 0.905 42.7 9.6 resource pressure This invention 0.881 0.930 31.4 4.5 High resource pressure Transformer 0.821 0.884 49.8 12.9 High resource pressure This invention 0.874 0.923 34.7 5.8

[0236] As can be seen from Table 3, the resource status awareness gating mechanism can make more stable adjustments to the model structure when the edge device resources are limited or the load fluctuates greatly, thereby maintaining good anomaly detection performance and output stability.

[0237] Table 4 Ablation Experiment Results

[0238] Model variants F1 AUC Average inference latency / ms Alarm jitter rate / % De-double threshold hysteresis 0.869 0.925 30.2 9.8 De-cross-variable collaborative branches 0.854 0.913 27.9 5.1 Remove downscaling branches 0.861 0.918 28.6 5.4 Remove resource state-aware gating 0.858 0.916 40.6 8.7 This invention 0.882 0.931 30.8 4.3

[0239] As shown in Table 4, removing the dual-threshold hysteresis significantly increases the alarm jitter rate of the model, indicating that the dual-threshold hysteresis mechanism can effectively suppress repeated switching of abnormal states caused by score fluctuations near the decision boundary. Removing the intervariate collaborative branch significantly reduces both the F1 score and AUC, indicating that intervariate collaborative modeling helps to characterize the coupling relationship between three-phase voltage, current, and power. Removing the downscaling branch also reduces the detection performance, indicating that slow-change trend modeling has a positive effect on the detection of timing anomalies in low-voltage distribution networks. Removing the resource state-aware gating significantly worsens both the average inference latency and alarm jitter rate, indicating that the resource state-aware gating mechanism helps to stabilize model structure switching and reduce inference overhead under resource fluctuation conditions.

Claims

1. A method for detecting time-series anomalies in low-voltage distribution networks based on edge resource sensing gating and dual-threshold hysteresis control, characterized in that, Includes the following steps: S1: Acquire multivariate time-series data of low-voltage distribution network and complete preprocessing and time slice construction; S2: Construct a multi-scale collaborative attention model based on time-slice sequences to extract local temporal features, downscaling features, and conditionally triggered cross-variable collaborative features; S3: During the model inference process, the CPU utilization, memory utilization and single forward inference latency of the edge device are obtained in real time, a resource state vector is constructed and the resource fitness is calculated; based on the relationship between the resource fitness and the preset upper and lower thresholds, the current model structure state is determined by the double threshold hysteresis rule, and the corresponding feature branch gating vector is generated. S4: Perform forward inference under the current model structure state, and fuse only the local temporal features and downscaling features activated by the feature branch gating vector; For cross-variable collaborative features, they are only fused when the corresponding branch is activated by the gating vector and the current time slice meets the local perturbation triggering condition; a reconstructed time slice sequence corresponding to the input time slice is generated based on the fusion result; S5: Calculate the anomaly score based on the reconstruction results, and determine the anomaly based on the double threshold hysteresis rule to obtain the detection results.

2. The low-voltage distribution network time series anomaly detection method based on edge resource sensing gating and dual-threshold hysteresis control according to claim 1, characterized in that, Step S1 includes: Continuous operation monitoring data is acquired from equipment on the low-voltage distribution network side or user-side acquisition terminals. The measured variables include three-phase voltage, three-phase current, and active / reactive power, forming a multivariate measurement time series. ； In the formula, Indicates the total number of sampling times. Indicates time The total variable measurement vector; Represents a multivariate measurement time series; Let the first Each measured variable at time... The value is The standardized result is: ； In the formula, and The first The mean and standard deviation of each measurement variable over the normal operating data segment; after standardization, the standardized multivariate time series is obtained: ； In the formula, Indicates time Standardized measurement vector; Represents standardized multivariate time series; uses a sliding window approach to represent standardized multivariate time series. Perform time slice construction; set the window length as... The sliding step size is Then the first Each time slice is represented as: ； In the formula, For the first Number of time slices This yields the time-slice sequence. This data is then used as input to a subsequent multi-scale collaborative attention model to characterize the local dynamic features of multivariate operating data in low-voltage distribution networks within a continuous time window.

3. The low-voltage distribution network time series anomaly detection method based on edge resource sensing gating and dual-threshold hysteresis control according to claim 1, characterized in that, Step S2 includes: S2.1: A local temporal attention mechanism is introduced within each time slice, assigning adaptive weights to different time positions within the slice in the time dimension to obtain the local encoding features of the time slice. According to the local coding features Calculate the local disturbance intensity index ; S2.2: Introducing a time-slice downscaling fusion strategy, this approach compresses and aggregates multiple adjacent time slices over a longer time span to extract long-term trend information across time slices, thus obtaining downscaling features. ; S2.3: Based on the extraction of local features and downscaling features, a conditionally triggered cross-variable collaborative modeling method is introduced, where the local perturbation intensity index of the time slice... Greater than or equal to the preset disturbance threshold When the current time slice meets the triggering conditions for enabling cross-variable collaborative modeling, the dependencies and collaborative change patterns among the measured variables are modeled to obtain cross-variable collaborative features. When the local disturbance intensity index of the time slice Less than the preset disturbance threshold If the current time slice does not meet the triggering conditions for cross-variable collaborative modeling, then the cross-variable collaborative branch corresponding to the current time slice remains in an untriggered state.

4. The low-voltage distribution network time series anomaly detection method based on edge resource sensing gating and dual-threshold hysteresis control according to claim 3, characterized in that, The preset disturbance threshold in step S2.3 According to the local disturbance intensity index The mean and standard deviation are determined in the normal operating data segment, that is: ； In the formula, and These represent the local disturbance intensity indices. The mean and standard deviation in the normal operating data segment. This is the threshold adjustment coefficient.

5. The low-voltage distribution network time series anomaly detection method based on edge resource sensing gating and dual-threshold hysteresis control according to claim 1, characterized in that, Step S3, which involves constructing the resource state vector and calculating the resource fitness, includes: Assume the first The resource amounts collected during each inference iteration, namely CPU utilization, memory utilization, and model latency per forward inference iteration, are respectively: , and The resource quantity adopts a length of The resource statistics are smoothed by applying a sliding window: ； In the formula, The smoothed CPU utilization is adjusted to the resource status smoothing window length. Memory usage Model single forward inference latency Normalize the ratios of each resource component to the corresponding resource budget ceiling to obtain the normalized resource components. , and : ； In the formula, , and These represent the upper limits of CPU utilization budget, memory utilization budget, and model single forward inference latency budget, respectively; when the normalization result exceeds 1, it is truncated to 1; construct the... The resource state vector corresponding to the next inference step: ； Based on the resource state vector, calculate the first... Resource fitness score corresponding to the next reasoning step : ； In the formula, , and , which are weighting coefficients used to characterize the importance of different resource indicators.

6. The low-voltage distribution network time series anomaly detection method based on edge resource sensing gating and dual-threshold hysteresis control according to claim 1, characterized in that, The step S3, which involves determining the current model structure state and generating the corresponding feature branch gating vector, includes: Based on resource fitness score With preset upper threshold Lower threshold The relationship determines the current model structure state: when When the current edge device is determined to be in a high-resource state, a more complete multi-scale collaborative attention structure can be enabled. when When the current edge device is determined to be in a low resource state, the model structure is simplified. when At the same time, the current model structure state remains unchanged; When the model structure state changes, the current gating vector remains unchanged within the preset continuous inference cycle; Based on the determined current model structure state, generate the first... Feature branch gating vector corresponding to each inference step: ； In the formula, and These are used to control the local temporal feature branch, the downscaling feature branch, and the intervariate collaborative feature branch respectively in the 1st... The activation status during the time slice encoding process, with a value of 1 indicating that the corresponding branch is activated and a value of 0 indicating that the corresponding branch is suppressed; Indicates the first Feature branch gating vectors corresponding to each inference step; When the model structure is in a high-resource state, take When the model structure state is in the medium resource state, take... When the model structure is in a low-resource state, take... .

7. The method for detecting time series anomalies in low-voltage distribution networks based on edge resource sensing gating and dual-threshold hysteresis control according to claim 1, characterized in that, Step S4 includes: Under the current model structure determined in step S3, forward inference is performed on the preprocessed low-voltage distribution network time-slice sequence, and the low-voltage distribution network time-slice sequence is sequentially input into the gated and adjusted multi-scale collaborative attention model; for the first... Each time slice, based on the current gate vector and local disturbance trigger flags The feature extraction branches involved in the time slice encoding are determined, and only the outputs of the activated branches are fused to obtain the first... Multi-scale coding representation of time slices ; The multi-scale coding representation satisfies: ； In the formula, , and These represent local temporal features, downscaling features, and cross-variable collaborative features, respectively. , and These represent the corresponding feature branches at the th... Gating states during a time-slice encoding process; This indicates the local perturbation triggering flag for cross-variable cooperative branching, thereby forming a multi-scale feature sequence. ; The model output layer generates a reconstruction result corresponding to the input time slice based on the encoded representation formed under the current model structure state. For the th time slice... Each time slice yields a reconstructed vector at the output layer. And transpose it to a reconstructed time slice with the same dimension as the input time slice. : ； In the formula, and For output layer parameters, For the first The reconstruction results of each time slice.

8. The low-voltage distribution network time series anomaly detection method based on edge resource sensing gating and dual-threshold hysteresis control according to claim 7, characterized in that, The forward inference process further includes extracting the corresponding attention weight matrix from the attention branches activated in the current gating state as auxiliary information for anomaly analysis. The attention matrix corresponding to the local temporal attention module... Used to characterize the importance distribution among different sampling moments within a time slice; attention matrix corresponding to the cross-variable collaborative attention module. It is used to characterize the coupling relationship and cooperative change pattern between different electrical measurement variables.

9. The method for detecting time series anomalies in low-voltage distribution networks based on edge resource sensing gating and dual-threshold hysteresis control according to claim 1, characterized in that, Step S5 includes: Based on the reconstructed time slice sequence output in step S4 With the corresponding input time slice sequence Calculate the residual matrix for each time slice: ； in, , Indicates the number of monitored variables. Indicates the time slice length; based on the reconstructed residual matrix The residual energy, constructing the first Time-slice-level anomaly rating for each time slice: ； Let the sliding step size be... , No. The time interval covered by each time slice is denoted as: ； For any given moment Let the set of time slice indices covering this moment be: ； The time point score at that moment is defined as follows: ； Based on the statistical results of time-point scores in normal operation data segments or offline calibration data segments, a dual threshold for anomaly detection is determined. and ,in: ； And satisfy ; In the formula, and These represent the mean and standard deviation of the scores for the corresponding time points in the normal operation data, respectively. and These are the high threshold adjustment coefficient and the low threshold adjustment coefficient, respectively. For each moment abnormal state The determination is made using a dual-threshold hysteresis method: Scoring at the point in time Greater than or equal to the high threshold When this happens, the current moment will be considered abnormal; Scoring at the point in time Less than or equal to the low threshold At that time, the current moment will be judged as normal; When the score at a given time point is between the low and high thresholds, the judgment state of the previous time point remains unchanged. This yields the final anomaly detection result sequence: ； In the formula, Indicates each time point Abnormal state; This represents the final sequence of anomaly detection results.

Images