Convolution-based power grid monitoring alarm event identification method and system

Abstract

This application relates to the field of power grid monitoring technology and discloses a method and system for identifying power grid monitoring alarm events based on convolution. The method includes: acquiring the time-series electrical quantity data and topological connectivity of power grid monitoring nodes, constructing a normalized adjacency matrix and a node feature matrix; performing graph convolution processing to generate node embedding feature tensors; identifying alarm nodes based on Euclidean distance, filtering candidate edges according to time-series relationships and topological distances, and enumerating a set of candidate propagation paths; performing one-dimensional convolutional encoding and weighted fusion on the candidate propagation paths, and outputting the alarm event category. This application solves the problem of low identification accuracy caused by existing power grid monitoring alarm event identification methods ignoring the power grid topology and alarm propagation paths.

Description

Technical Field

[0001] This application relates to the field of power grid monitoring technology, and in particular to a method and system for identifying power grid monitoring alarm events based on convolution. Background Technology

[0002] Power grid monitoring alarm event identification technology is a crucial means to ensure the safe and stable operation of the power grid. Existing convolutional-based power grid monitoring alarm event identification methods typically employ one-dimensional or two-dimensional convolutional neural networks to extract features from time-series data such as voltage, current, and power collected by monitoring nodes. This method arranges the time-series data from multiple monitoring nodes into a matrix in chronological order, extracts local temporal features by sliding convolutional kernels along the time dimension, and after multiple convolutional and pooling operations, uses a fully connected layer to classify and output alarm event categories. This method can automatically learn pattern features in time-series data, exhibiting stronger adaptability and higher recognition accuracy compared to traditional rule-based or threshold-based methods.

[0003] However, existing convolutional-based methods treat power grid monitoring data as independent time-series signals, completely ignoring the physical topology of the power grid and the electrical connections between nodes. The monitoring nodes in a power grid are interconnected through transmission lines, transformers, and buses, forming a complex topology network. The electrical states between nodes are not independent but strongly coupled, and faults or anomalies propagate along the topological connection paths between nodes. Existing methods use a uniform convolutional kernel for feature extraction from all node data, failing to distinguish the differences in node positions within the topology. This results in extracted features lacking topological semantic information, making it difficult to accurately identify complex alarm events that require comprehensive spatial correlation information from multiple nodes. Summary of the Invention

[0004] This application provides a convolution-based method and system for identifying power grid monitoring alarm events, addressing the problem of low accuracy in existing convolution-based power grid monitoring alarm event identification methods that ignore power grid topology and alarm propagation paths. By fusing topology-aware graph convolutional feature extraction with one-dimensional convolutional encoding based on propagation paths, the identification accuracy and fault tracing capabilities are improved.

[0005] Firstly, this application provides a convolution-based method for identifying power grid monitoring alarm events, the method comprising: Step S1: Obtain the electrical quantity time series data of each monitoring node in the power grid and the topological connection relationship between the nodes, and construct the normalized adjacency matrix and the node feature matrix; Step S2: Perform graph convolution processing on the normalized adjacency matrix and the node feature matrix to generate a node embedding feature tensor with fused topology structure; Step S3: Calculate the Euclidean distance between each node and the normal operation prototype vector based on the node embedding feature tensor to identify alarm nodes and trigger times. According to the temporal relationship of the propagation of power grid faults along electrical lines and the shortest path distance in the topology, screen directed candidate edges that conform to the physical propagation law of the power grid, and enumerate to generate a set of candidate propagation paths for alarm events. Step S4: Perform one-dimensional convolutional encoding and weighted fusion on the candidate propagation paths to generate event feature vectors and output alarm event categories.

[0006] Secondly, this application provides a convolution-based power grid monitoring alarm event recognition system, the convolution-based power grid monitoring alarm event recognition system comprising: The acquisition module is used to acquire the electrical quantity time series data of each monitoring node in the power grid and the topological connection relationship between the nodes, and to construct a normalized adjacency matrix and a node feature matrix. The convolution module is used to perform graph convolution processing on the normalized adjacency matrix and the node feature matrix to generate a node embedding feature tensor with a fused topological structure. The filtering module is used to calculate the Euclidean distance between each node and the normal operation prototype vector based on the node embedded feature tensor to identify alarm nodes and trigger times. According to the temporal relationship of the propagation of power grid faults along electrical lines and the shortest path distance of the topology, it filters directed candidate edges that conform to the physical propagation law of the power grid and enumerates to generate a set of candidate propagation paths for alarm events. The fusion module is used to perform one-dimensional convolutional encoding and weighted fusion on the candidate propagation paths, generate event feature vectors, and output alarm event categories.

[0007] The technical solution provided in this application constructs a normalized adjacency matrix to represent the physical topological connections of the power grid. It integrates the transmission line, transformer, and bus connection information between power grid monitoring nodes into the identification process in a graph structure, enabling subsequent feature extraction to move beyond isolated time-series data of individual nodes and instead perceive the spatial location and neighborhood relationships of nodes within the power grid topology. Graph convolution processing aggregates neighborhood information through the normalized adjacency matrix, ensuring that each node's embedded features simultaneously include its own electrical state information and the state information of its surrounding neighbors. This automatically learns the electrical coupling relationships and topological semantic features between nodes, overcoming the shortcomings of traditional convolution methods that treat all nodes equally while ignoring topological differences. This feature representation method, which integrates topological structures, allows the model to distinguish between hub nodes at the topology center and edge nodes, identify complex alarm patterns that require comprehensive spatial correlation of multiple nodes for judgment, and improve the accuracy of identifying alarm events involving multi-node collaborative anomalies.

[0008] Alarm nodes and trigger times are identified by calculating Euclidean distance using node embedding feature tensors. Directed candidate edges are selected based on the temporal sequence of power grid fault propagation along electrical lines and the shortest path distance in the topology, and a candidate propagation path set is generated through enumeration. This transforms alarm event identification from a static pattern matching problem into a dynamic propagation path tracking problem, consistent with the physical nature of power grid fault propagation. A triple screening mechanism—temporal constraints, propagation delay constraints, and topological distance constraints—effectively filters out false associations that do not conform to the physical laws of propagation, ensuring that all paths in the candidate path set satisfy the causal logic of power grid fault propagation. When performing one-dimensional convolutional encoding on the candidate propagation paths, the convolutional kernel slides along the node sequence direction of the path, specifically extracting the propagation pattern features between consecutive nodes. Different convolutional kernels learn the characteristic propagation laws of different types of faults, enabling the model to obtain discriminative information from the propagation dynamics of alarms. The weighted fusion mechanism differentiates the encoded vectors of each path based on the path credibility score, assigning greater weight to paths that conform to the real propagation law, suppressing the interference of noisy paths and false associations. The generated event feature vector integrates the information of all candidate paths but highlights the dominant propagation mode, improving the robustness and interpretability of identifying complex propagation fault events. It provides power grid dispatchers with clear information on fault propagation paths and source locations, supporting rapid fault location and emergency response decisions. Attached Figure Description

[0009] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Figure 1 This is a schematic diagram of an embodiment of the power grid monitoring alarm event recognition method based on convolution in this application. Figure 2 This is a schematic diagram of the loss function change curve during the training process in an embodiment of this application; Figure 3 This is a schematic diagram of the accuracy change curve during the training process in an embodiment of this application; Figure 4 This is a confusion matrix showing the recognition effect of six typical alarm events in the embodiments of this application. Detailed Implementation

[0010] This application provides a method and system for identifying power grid monitoring alarm events based on convolution. The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0011] For ease of understanding, the specific process of the embodiments of this application is described below. Please refer to [link / reference]. Figure 1 One embodiment of the power grid monitoring alarm event identification method based on convolution in this application includes: Step S1: Obtain the electrical quantity time series data of each monitoring node in the power grid and the topological connection relationship between the nodes, and construct the normalized adjacency matrix and the node feature matrix; Step S2: Perform graph convolution on the normalized adjacency matrix and the node feature matrix to generate a node embedding feature tensor with fused topology structure. Step S3: Calculate the Euclidean distance between each node and the normal operation prototype vector based on the node embedding feature tensor to identify alarm nodes and trigger times. Based on the temporal relationship of the propagation of power grid faults along electrical lines and the shortest path distance in the topology, screen directed candidate edges that conform to the physical propagation law of the power grid, and enumerate to generate a set of candidate propagation paths for alarm events. Step S4: Perform one-dimensional convolutional encoding and weighted fusion on the candidate propagation paths to generate event feature vectors and output alarm event categories.

[0012] It is understood that the executing entity of this application can be a convolution-based power grid monitoring alarm event recognition system, or it can be a terminal or a server; the specific implementation is not limited here. This application's embodiment uses a server as an example for illustration.

[0013] Specifically, time-series data of electrical quantities such as three-phase voltage, three-phase current, active power, and reactive power are collected from the power grid SCADA system at each monitoring node. Simultaneously, the connection relationships between transmission lines, transformers, and buses between nodes are obtained from the primary wiring diagram of the power grid to construct an undirected graph. After calculating the adjacency matrix of this graph, symmetric normalization is performed using the negative 1 / 2 power of the degree matrix to obtain a normalized adjacency matrix. Meanwhile, the original electrical quantity data is Z-score normalized and discretized according to the time step to generate a node feature matrix. The normalized adjacency matrix and the node feature matrix are input into a graph convolutional network. Neighborhood information aggregation is achieved through two layers of graph convolution operations, ensuring that each node's features not only include its own electrical quantity information but also incorporate the state information of its neighboring nodes within a two-hop range in the power grid topology, generating a node embedding feature tensor.

[0014] Next, the Euclidean distance between the embedded features of each node and the normal operating prototype vector is calculated. When the distance exceeds a threshold, it is identified as an alarm node and the trigger time is recorded. Based on the order of alarm times, it is determined that the first node triggered earlier than the second node. The difference between the trigger times of the two nodes is calculated to see if it is less than the maximum propagation delay. At the same time, the shortest path length between the two nodes is calculated based on the normalized adjacency matrix to see if it does not exceed the maximum number of hops. When the three conditions of temporal order, propagation delay, and topological distance are satisfied simultaneously, the directed edge from the first node to the second node is added to the candidate edge set. Then, starting from the node with the earliest trigger time, a depth-first search is performed to expand based on the candidate edge set. Subsequent nodes are visited sequentially along the directed edges to form a node sequence. The process terminates when the sequence length reaches the maximum path length or there are no expandable edges, generating a candidate propagation path set.

[0015] Finally, for each candidate path, the node embedding features of each node within the time window before and after the alarm trigger time are extracted. Average pooling along the time dimension is used to obtain the path node feature vectors. These feature vectors are then arranged in node order to form a path feature matrix. A one-dimensional convolutional kernel is applied to the path feature matrix along the node sequence direction. The kernel slides along the path to capture the propagation pattern between consecutive nodes. Dimensionality reduction through max pooling and fully connected layers yields the path encoding vector. The path encoding vector is input into a scoring network to calculate a confidence score. After score normalization, the path encoding vectors are weighted and fused to obtain an event feature vector, which is then input into a classification network to output the alarm event category. For example, in a substation where a line short-circuit fault occurs, the fault current propagates along the line to adjacent stations. Graph convolution integrates the features of each node with neighborhood information. Distance calculation identifies three alarm nodes triggered in time sequence. Directed edges are selected based on time delay and topological constraints. Depth-first search generates a propagation path containing these three nodes. A one-dimensional convolutional kernel extracts propagation pattern features along this path. The scoring network determines the path has high confidence and assigns it a large fusion weight. The classifier outputs the line short-circuit fault category.

[0016] In one specific embodiment, step S1 includes: Data on three-phase voltage, three-phase current, active power, and reactive power of N monitoring nodes within a time window are collected from the power grid SCADA system to form a raw electrical quantity time series dataset. Based on the primary wiring diagram of the power grid, determine the transmission line connection relationship, transformer connection relationship and bus connection relationship between monitoring nodes, construct an undirected graph and calculate the adjacency matrix; Calculate the degree matrix of the adjacency matrix, and then perform symmetric normalization on the adjacency matrix by raising the degree matrix to the negative first power of 2 to obtain the normalized adjacency matrix. The electrical parameters of each monitoring node in the original electrical quantity time series dataset are Z-score standardized and discretized according to the time step to generate a node feature matrix.

[0017] Specifically, when collecting electrical quantity data from N monitoring nodes within a time window from the power grid SCADA system, each node collects three-phase voltage (A-phase, B-phase, and C-phase voltage), three-phase current (A-phase, B-phase, and C-phase current), and active and reactive power—a total of eight electrical parameters. The sampling frequency is set to 100Hz. The time window length is set based on the typical duration of the alarm event. Data collected from all nodes within this time window is aggregated to form the original electrical quantity time-series dataset. When determining the connection relationships between nodes based on the power grid primary wiring diagram, transmission line connections indicate that two substations are directly connected via overhead lines or cable lines; transformer connections indicate that nodes are connected via main transformers or tie transformers; and busbar connections indicate that multiple nodes are connected to the same busbar. The N monitoring nodes are treated as a set of nodes in a graph. When any of the above connection relationships exist between nodes, an undirected edge is added to the edge set. After constructing the undirected graph, the adjacency matrix is ​​calculated. An element of 1 in the matrix indicates that the corresponding nodes are directly connected, and an element of 0 indicates that they are not connected.

[0018] When calculating the degree matrix of the adjacency matrix, the degree matrix is ​​a diagonal matrix. The i-th element on the diagonal is equal to the sum of all elements in the i-th row of the adjacency matrix, representing the number of connected edges of node i. Symmetric normalization is achieved by left-multiplying and right-multiplying the degree matrix by its negative 1 / 2 power by the adjacency matrix. The calculation process involves first taking the negative 1 / 2 power of each diagonal element of the degree matrix, and then performing two matrix multiplication operations with the adjacency matrix. The resulting normalized adjacency matrix appropriately weakens the influence weight of hub nodes with larger degrees on their neighboring nodes, and appropriately strengthens the influence weight of end nodes with smaller degrees, avoiding information propagation deviations caused by topological imbalances. When performing Z-score standardization on the original electrical quantity time series data, the historical mean and standard deviation of each electrical parameter for each monitoring node are calculated. The current value is then subtracted from the mean and divided by the standard deviation to eliminate differences in the dimensions and numerical ranges of different electrical parameters. Discretization by time step divides the continuously sampled time-series data into segments at fixed time intervals. Each time step corresponds to an electrical parameter vector at a given moment. The vectors of all time steps are arranged in chronological order to form a node feature matrix. The number of rows in the matrix represents the number of time steps, and the number of columns represents the number of electrical parameters.

[0019] In one specific embodiment, identifying the alarm node and trigger time includes: The node embedding feature tensor of each monitoring node under normal operating conditions is averaged in the time dimension to obtain the normal operating prototype vector of each node. Calculate the Euclidean distance between the embedded feature vector of each monitoring node at the current moment and the normal operation prototype vector; The Euclidean distance is compared with a preset alarm threshold. When the Euclidean distance is greater than the preset alarm threshold, the node is marked as having triggered an alarm at that moment. Extract all alarm nodes and their trigger times in chronological order to generate an alarm event sequence.

[0020] Specifically, when performing time-dimensional average pooling on the node embedding feature tensor of each monitoring node under normal operating conditions, it is first necessary to collect historical data of each node under normal power grid operating conditions offline. This data is processed by graph convolution to obtain the node embedding feature tensor. The dimension of this tensor is the time step multiplied by the embedding dimension. Time-dimensional average pooling is performed by arithmetically averaging all vectors of this tensor along the time dimension. Specifically, the calculation involves adding the elements at corresponding positions of the embedding feature vector at each time step and dividing by the total number of time steps to obtain a fixed-dimensional vector as the normal operating prototype vector of that node. This prototype vector represents the typical electrical characteristic pattern of the node under normal operating conditions and serves as a benchmark reference for subsequent anomaly detection. When calculating the Euclidean distance between the embedding feature vector of each monitoring node at the current moment and the normal operating prototype vector, the embedding feature vector is the vector obtained after graph convolution at the current moment. The Euclidean distance is calculated as the square root of the sum of the squares of the differences between corresponding elements of the two vectors. This distance reflects the degree of deviation between the current electrical state and the normal state; the larger the distance, the more severe the deviation.

[0021] When comparing the Euclidean distance with a preset alarm threshold, the preset alarm threshold is determined based on the statistical characteristics of historical normal operation data. It is typically set as the mean Euclidean distance under normal conditions plus a certain number of standard deviations, with the multiplier adjusted according to the power grid safety level and false alarm tolerance. When the calculated Euclidean distance exceeds this threshold, the node's state is determined to have significantly deviated from the normal mode at the current moment, and the node is marked as having triggered an alarm at that moment. Simultaneously, the node's identification number and the precise time of alarm triggering are recorded. Extracting all alarm nodes and their trigger times in chronological order requires traversing every moment within the entire time window and every monitoring node. All nodes marked as alarmed and their corresponding trigger times are extracted and arranged in ascending order of trigger time, forming an alarm event sequence. Each element in this sequence is a binary tuple containing the alarm node's unique identifier and the specific time the alarm occurred. The sequence order ensures that the temporal relationship of alarm events can be correctly identified during subsequent propagation path construction, laying the foundation for determining the direction of fault propagation.

[0022] In one specific embodiment, screening directed candidate edges that conform to the physical propagation laws of the power grid includes: Based on any two alarm nodes in the alarm event sequence, determine whether the triggering time of the first alarm node is earlier than the triggering time of the second alarm node; Calculate the trigger time difference between the first alarm node and the second alarm node, and determine whether the time difference is less than the preset maximum propagation delay; The shortest path length from the first alarm node to the second alarm node is calculated based on the normalized adjacency matrix, and it is determined whether the shortest path length does not exceed the preset maximum number of hops. When the timing order condition, propagation delay condition, and topological distance condition are all met simultaneously, the directed edge from the first alarm node to the second alarm node is added to the candidate edge set.

[0023] Specifically, when determining the timing relationship between any two alarm nodes in an alarm event sequence, it is necessary to extract the first alarm node and its trigger time, and the second alarm node and its trigger time from the sequence, and directly compare the numerical values ​​of the two times. The trigger time is usually recorded in the form of a timestamp, representing the number of milliseconds or microseconds that have elapsed since a certain reference time point. If the time value of the first alarm node is less than the time value of the second alarm node, then the first node was triggered earlier than the second node, satisfying the timing condition. This judgment is based on the fundamental physical law of power grid fault propagation, that is, a fault must start from the source node and spread to subsequent nodes along the electrical connection path; there is no reverse propagation. Therefore, only the node with the earlier time can be the source of propagation for the node with the later time.

[0024] When calculating the trigger time difference between the first and second alarm nodes, the trigger time of the second node is subtracted from the trigger time of the first node. The resulting difference represents the time required for the alarm to propagate from the first node to the second node. This difference is compared with a preset maximum propagation delay, which is determined based on the propagation speed of fault signals in the power grid and the response delay of the monitoring system. While the propagation speed of electromagnetic waves in transmission lines is close to the speed of light, the actual observable propagation delay is significantly increased considering the action time of protection devices, signal acquisition delay, and data transmission delay. If the calculated time difference is less than the maximum propagation delay, it indicates that the two alarms are sufficiently close in time, suggesting a possible causal propagation. When calculating the shortest path length from the first alarm node to the second alarm node based on the normalized adjacency matrix, a breadth-first search algorithm is used. Starting from the first node, it expands its neighboring nodes layer by layer until the second node is reached or all reachable nodes have been traversed. The shortest path length is the minimum number of edges traversed from the first node to the second node, reflecting the distance between the two nodes in the power grid topology.

[0025] When determining whether the shortest path length does not exceed the preset maximum number of hops, the maximum number of hops is set based on the typical propagation range of a power grid fault, typically 3 or 4 hops. The impact range of a power grid fault is limited by the configuration of protection devices and electrical isolation measures; nodes beyond a certain distance will not be directly affected. If the shortest path length does not exceed the maximum number of hops, it indicates that the two nodes are topologically close enough to have the possibility of physical propagation. When the timing sequence condition, propagation delay condition, and topological distance condition are all satisfied simultaneously, it is considered that there is a causal relationship between the first alarm node and the second alarm node that conforms to the physical propagation law of the power grid, and the directed edge from the first node to the second node is added to the candidate edge set. Each directed edge in the candidate edge set represents a possible fault propagation link. Multiple edges connected together form a complete propagation path. The more edges included in the set, the richer the subsequent enumerable propagation path combinations, but a path scoring mechanism is still needed to filter out the true propagation paths.

[0026] In one specific embodiment, the set of candidate propagation paths for generating alarm events is enumerated, including: Select the alarm node with the earliest trigger time from the alarm event sequence as the starting node of the path; The starting node is expanded by depth-first search based on the candidate edge set, and subsequent nodes are visited sequentially along the directed candidate edges to form a node sequence. The search terminates when the node sequence length reaches the preset maximum path length or there are no expandable candidate edges, and the node sequence is recorded as a candidate propagation path. Repeat the search and expansion process until all possible propagation paths have been traversed, generating a set of candidate propagation paths.

[0027] Specifically, the alarm node with the earliest trigger time is selected from the alarm event sequence as the starting node of the path. This is because fault propagation always starts from the location where the anomaly initially occurred and spreads outwards, and the earliest alarm node is most likely the source of the fault. When expanding the starting node using a depth-first search based on the candidate edge set, first, all directed edges in the candidate edge set originating from the starting node are searched, each edge pointing to a subsequent node. One of these edges is selected to visit the corresponding subsequent node, and that node is added to the node sequence. Then, starting from this newly visited node, directed edges originating from it are searched, and one edge is selected to visit the next node, and so on recursively. The characteristic of depth-first search is to explore as deeply as possible along a path until it cannot be expanded further, at which point it backtracks to the previous node to try other branches. When the node sequence length reaches the preset maximum path length, it means that the path is long enough, and continuing to expand would lead to excessive computational complexity and not conform to the actual fault propagation range. At this point, the search for the current path is terminated, and the formed node sequence is recorded as a candidate propagation path. If the current node has no expandable candidate edges before the path length reaches its maximum value, that is, if there are no edges in the candidate edge set that start from the current node, the search is terminated and the current node sequence is recorded.

[0028] During the repeated search expansion process, the system backtracks to the previous branch point, selects another unvisited outgoing edge of that node, and continues the depth-first search to generate new candidate propagation paths. Traversing all possible propagation paths requires exhaustively listing all path combinations originating from the starting node, including short paths directly reachable by a single edge and long paths passing through multiple intermediate nodes. After each search generates a path, the system marks visited edges and nodes to avoid repeatedly searching the same path. When all paths reachable from the starting node have been enumerated and no new unvisited paths are found, the search process ends, generating a candidate propagation path set. This set contains all possible propagation paths that meet timing, delay, and topology constraints. The number of paths depends on the size of the candidate edge set and the complexity of the power grid topology. Each path in the set is a sequence of nodes arranged in propagation order. Subsequently, convolutional encoding is used to extract the propagation pattern features of each path, and a scoring mechanism is used to filter out the true fault propagation paths.

[0029] In one specific embodiment, step S2 includes: Multiply the node feature matrix at each time step with the normalized adjacency matrix to aggregate the neighborhood node features of each monitored node. The aggregated feature matrix is ​​multiplied by the first-layer graph convolution weight matrix, and the first-layer graph convolution features are generated by the ReLU activation function. After multiplying the first-layer graph convolutional features with the normalized adjacency matrix, a matrix multiplication operation is performed with the second-layer graph convolutional weight matrix and activated to generate the second-layer graph convolutional features. The second-layer graph convolutional features of each monitoring node at each time step are stacked along the time dimension to generate a node embedding feature tensor.

[0030] Specifically, when multiplying the node feature matrix at each time step with the normalized adjacency matrix, each row of the node feature matrix represents the electrical parameter vector of a monitoring node, and each row of the normalized adjacency matrix contains the normalized connection weights between that node and all its neighboring nodes. Matrix multiplication transforms each node's feature vector into a weighted sum of its own features and the features of all its neighboring nodes, with the weights determined by the corresponding elements in the normalized adjacency matrix. After aggregating the features of each monitoring node's neighboring nodes, the feature vector, which originally contained only information about a single node, now incorporates information from all directly connected neighbors of that node in the power grid topology. When performing matrix multiplication on the aggregated feature matrix and the first-layer graph convolution weight matrix, the dimension of the first-layer weight matrix is ​​set to the input feature dimension multiplied by the first-layer output feature dimension. The input feature dimension equals the number of columns in the node feature matrix, i.e., the number of electrical parameters, and the first-layer output feature dimension is set to 64. The initial values ​​of the weight matrix are generated using the Xavier initialization method, and the weight parameters are updated during the training phase using the backpropagation algorithm based on the gradient of the loss function. After matrix multiplication, a non-linear transformation is performed on each element of the result using the ReLU activation function. The ReLU function sets all negative values ​​to zero while keeping positive values ​​unchanged, generating the first layer of graph convolutional features.

[0031] The first-layer graph convolutional features are multiplied by the normalized adjacency matrix to achieve the second neighborhood information aggregation. At this point, the features of each node are expanded to a 2-hop neighborhood, meaning that the information of all nodes within a distance of no more than two edges from that node is incorporated. The aggregated feature matrix is ​​then multiplied by the second-layer graph convolutional weight matrix. The second-layer weight matrix has a dimension of 64 x 128, mapping the 64-dimensional features of the first layer to a 128-dimensional feature space. The weight matrix is ​​also initialized using Xavier and updated during training. The second-layer graph convolutional features are generated after processing with the ReLU activation function. During training, historically labeled alarm event data is used as the training set. Each sample contains power grid monitoring data, topology structure, and corresponding alarm event category label. The loss function is cross-entropy loss, the optimizer is Adam optimizer, the learning rate is set to 0.001, the batch size is set to 32, and the number of training epochs is 100. When stacking the second-layer graph convolutional features of each monitoring node at each time step along the time dimension, for each node, extract its 128-dimensional feature vectors at all times within the time window, arrange them into a matrix in chronological order, and generate the embedded feature tensor of that node. The tensor dimension is the number of time steps multiplied by 128, and it contains both temporal evolution information and topological structure information.

[0032] Figure 2The diagram illustrates the change curve of the loss function during the training process. Both the training set loss and the validation set loss decrease rapidly with the increase of the number of training rounds, with the most significant decrease in the first 20 rounds. After that, they gradually converge and remain stable. Finally, the training set loss converges to about 0.15 and the validation set loss converges to about 0.25. The small difference between the two indicates that the model has not shown obvious overfitting.

[0033] Figure 3 The diagram illustrates the accuracy curves during the training process. Both the training set accuracy and the validation set accuracy increase rapidly with the number of training rounds, showing the most rapid increase in the first 30 rounds. After that, the growth slows down, and the final training set accuracy reaches about 98%, while the validation set accuracy reaches about 93%. This verifies that graph convolutional networks can effectively extract topological sensing features of the power grid, and classification networks can accurately identify alarm event categories.

[0034] In one specific embodiment, step S4 includes: Extract the node embedding features of each node in each candidate propagation path within the time window before and after the alarm trigger time, and obtain the path node feature vector by average pooling along the time dimension. Arrange the path node feature vectors of each candidate propagation path in node order to form a path feature matrix, and fill the path with zeros if the path is not long enough. The path feature matrix is ​​convolved along the node sequence direction by applying a one-dimensional convolution kernel and then max pooling. The path encoding vector is obtained by dimensionality reduction through a fully connected layer. The path encoding vector is input into the path scoring network to calculate the credibility score of each path. After normalizing the credibility scores, the path encoding vectors are weighted and fused to obtain the event feature vector, which is then input into the classification network to output the alarm event category.

[0035] Specifically, when extracting the node embedding features of each node in each candidate propagation path within the time window before and after the alarm trigger time, for each node in the path, the alarm trigger time of that node is first obtained. Then, a fixed time window is extended forward and backward from that time, with a window length of 50 milliseconds. That is, the node embedding features within the range of 50 milliseconds before and after the trigger time are extracted. This time window contains feature vectors from multiple time steps. The arithmetic mean of the corresponding elements of these feature vectors is calculated by average pooling along the time dimension to obtain a fixed-dimensional path node feature vector. This vector has a dimension of 128, which condenses the electrical state change features of the node before and after the alarm occurs. When arranging the path node feature vectors of each candidate propagation path in the order of nodes to form a path feature matrix, for a propagation path containing m nodes, the feature vectors of these m nodes are arranged into a matrix in the order of propagation from the starting node to the ending node. The matrix has a dimension of m rows and 128 columns. Zero-padding is used for paths that are not long enough because different candidate paths contain different numbers of nodes. In order to unify the input dimension and facilitate batch processing, the maximum path length is set to 6 nodes. For paths with fewer than 6 nodes, a row vector of all zeros is added to the end of the matrix until the number of rows reaches 6, forming a path feature matrix of 6 rows and 128 columns with a unified dimension.

[0036] When applying a one-dimensional convolution kernel to the path feature matrix along the node sequence direction, the kernel size is set to 3, indicating that the kernel covers the features of 3 consecutive nodes. The number of convolution kernels is set to 256, with a stride of 1. The convolution operation slides along the node sequence direction of the path, extracting the features of 3 consecutive nodes at each slide and performing a weighted sum. The 256 different convolution kernels learn 256 different inter-node propagation patterns, and the kernel weights are learned through training. The convolutional features are then subjected to max pooling, taking the maximum value of each convolution kernel output along the node sequence dimension to obtain a 256-dimensional pooled feature vector. During dimensionality reduction using a fully connected layer, the weight matrix dimension is 256 multiplied by 128, mapping the pooled 256-dimensional features to a 128-dimensional space. The path encoding vector is then obtained after passing through the ReLU activation function. When the path encoding vector is input into the path scoring network, the scoring network contains two fully connected layers. The first layer maps the 128-dimensional path encoding to 64 dimensions, and the second layer maps the 64-dimensional features to a 1-dimensional scalar output. The output is then constrained to between 0 and 1 by a Sigmoid activation function, serving as the path credibility score. During training, real propagation paths from historical failure cases are labeled as positive samples (labeled 1), while randomly constructed paths that do not conform to physical laws are labeled as negative samples (labeled 0). The scoring network optimizes the weight parameters using a binary cross-entropy loss function. For credibility score normalization, the credibility scores of all candidate paths are summed as a normalization factor. Each path's score is divided by this factor to obtain a normalized weight, and the sum of all normalized weights equals 1. When weighted and fused, the 128-dimensional encoding vector of each path is multiplied by its normalized weight, and then all weighted vectors are summed element-wise to obtain a 128-dimensional event feature vector. When inputting into the classification network, it consists of three fully connected layers. The first layer maps 128 dimensions to 256 dimensions, the second layer maps to 128 dimensions, and the third layer maps to the dimension of the number of alarm event categories. The Softmax function outputs the probability distribution for each category, and the category with the highest probability is the recognition result. The classification network is trained using the cross-entropy loss function, with Adam as the optimizer, a learning rate of 0.001, a batch size of 32, and 100 training epochs.

[0037] Figure 4The confusion matrix of the recognition effect for six typical alarm events is presented. The rows of the matrix represent the true category, the columns represent the predicted category, the dark values ​​on the diagonal represent the number of correctly identified samples, and the light values ​​off-diagonal represent the number of misclassified samples. As shown in the figure, 145 samples were correctly identified for the line short circuit category, 138 for the main transformer overload category, 142 for the bus abnormality category, 140 for the protection malfunction category, 143 for the line grounding category, and 146 for the equipment aging category. The accuracy rate for each category exceeds 90%. The small number and dispersion of misclassified samples indicate that the method of this invention can effectively distinguish different types of alarm events, with low confusion between categories. This verifies that the one-dimensional convolutional coding and weighted fusion mechanism based on the propagation path can extract discriminative features of various alarm events, achieving high-precision multi-class recognition.

[0038] The above describes the power grid monitoring alarm event recognition method based on convolution in the embodiments of this application. The following describes the power grid monitoring alarm event recognition system based on convolution in the embodiments of this application. One embodiment of the power grid monitoring alarm event recognition system based on convolution in the embodiments of this application includes: The acquisition module is used to acquire the electrical quantity time series data of each monitoring node in the power grid and the topological connection relationship between the nodes, and to construct a normalized adjacency matrix and a node feature matrix. The convolution module is used to perform graph convolution processing on the normalized adjacency matrix and the node feature matrix to generate a node embedding feature tensor with fused topology structure. The filtering module is used to calculate the Euclidean distance between each node and the normal operation prototype vector based on the node embedding feature tensor to identify alarm nodes and trigger times. Based on the temporal relationship of the propagation of power grid faults along electrical lines and the shortest path distance in the topology, it filters directed candidate edges that conform to the physical propagation law of the power grid and enumerates to generate a set of candidate propagation paths for alarm events. The fusion module is used to perform one-dimensional convolutional encoding and weighted fusion on the candidate propagation paths, generate event feature vectors, and output alarm event categories.

[0039] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A convolution-based power grid monitoring alarm event identification method, characterized in that, The method comprises: Step S1, acquiring electrical quantity time series data of each monitoring node of the power grid and the topological connection relationship between nodes, constructing a normalized adjacency matrix and a node feature matrix; Step S2, performing graph convolution processing on the normalized adjacency matrix and the node feature matrix to generate a node embedding feature tensor fused with a topological structure; Step S3, calculating the Euclidean distance between each node and a normal operation prototype vector based on the node embedding feature tensor to identify an alarm node and a triggering time, screening a directed candidate edge meeting the physical propagation law of the power grid according to the time sequence relationship and the topological shortest path distance of the power grid fault propagation along the electrical line, and enumerating a candidate propagation path set of an alarm event; Step S4, performing one-dimensional convolution coding and weighted fusion on the candidate propagation path to generate an event feature vector and output an alarm event category.

2. The convolution-based power grid monitoring alarm event identification method of claim 1, wherein, The step S1 comprises: Collecting three-phase voltage, three-phase current, active power and reactive power data of N monitoring nodes in a time window from a power grid SCADA system to form an original electrical quantity time series data set; Determine the transmission line connection relationship, transformer connection relationship and bus connection relationship between the monitoring nodes according to the primary wiring diagram of the power grid, construct a undirected graph and calculate an adjacency matrix; Calculate the degree matrix of the adjacency matrix, and perform symmetric normalization processing on the adjacency matrix through the negative second power of the degree matrix to obtain a normalized adjacency matrix; Perform Z-score standardization processing on the electrical parameters of each monitoring node in the original electrical quantity time series data set and discretize by time step to generate a node feature matrix.

3. The convolution-based power grid monitoring alarm event identification method of claim 1, wherein, In the step S3, identifying an alarm node and a triggering time comprises: Performing time dimension average pooling on the node embedding feature tensor of each monitoring node under normal operation conditions to obtain a normal operation prototype vector of each node; Calculating the Euclidean distance between the embedding feature vector of each monitoring node at the current time and the normal operation prototype vector; Comparing the Euclidean distance with a preset alarm threshold, and marking the node as having an alarm at the time when the Euclidean distance is greater than the preset alarm threshold; Extracting all alarm nodes and their triggering times in chronological order to generate an alarm event sequence.

4. The convolution-based power grid monitoring alarm event identification method of claim 3, wherein, In the step S3, screening a directed candidate edge meeting the physical propagation law of the power grid comprises: Based on any two alarm nodes in the alarm event sequence, determining whether the triggering time of the first alarm node is earlier than the triggering time of the second alarm node; Calculating the triggering time difference between the first alarm node and the second alarm node, and determining whether the time difference is less than a preset maximum propagation time delay; Based on the normalized adjacency matrix, calculating the topological shortest path length from the first alarm node to the second alarm node, and determining whether the shortest path length is not more than a preset maximum hop count; When the time sequence condition, the propagation time delay condition and the topological distance condition are all met, a directed edge from the first alarm node to the second alarm node is added to the candidate edge set.

5. The convolution-based power grid monitoring alarm event identification method of claim 4, wherein, In the step S3, enumerating a candidate propagation path set of an alarm event comprises: Selecting an alarm node with the earliest triggering time from the alarm event sequence as a path starting node; Based on the candidate edge set, the starting node is expanded by a depth-first search, and subsequent nodes are visited sequentially along the directed candidate edges to form a node sequence. The search terminates when the node sequence length reaches the preset maximum path length or there are no expandable candidate edges, and the node sequence is recorded as a candidate propagation path. Repeat the search and expansion process until all possible propagation paths have been traversed, generating a set of candidate propagation paths.

6. The convolution-based power grid monitoring alarm event identification method of claim 1, wherein, Step S2 includes: Multiply the node feature matrix at each time point with the normalized adjacency matrix to aggregate the neighborhood node features of each monitoring node. The aggregated feature matrix is ​​multiplied by the first-layer graph convolution weight matrix, and the first-layer graph convolution features are generated by the ReLU activation function. After multiplying the first layer graph convolutional features with the normalized adjacency matrix, matrix multiplication is performed with the second layer graph convolutional weight matrix and activated to generate the second layer graph convolutional features. The second-layer graph convolutional features of each monitoring node at each time step are stacked along the time dimension to generate a node embedding feature tensor.

7. The convolution-based power grid monitoring alarm event identification method of claim 1, wherein, Step S4 includes: Extract the node embedding features of each node in each candidate propagation path within the time window before and after the alarm trigger time, and obtain the path node feature vector by average pooling along the time dimension. Arrange the path node feature vectors of each candidate propagation path in node order to form a path feature matrix, and fill the path with zeros if the path is not long enough. The path feature matrix is ​​convolved along the node sequence direction by applying a one-dimensional convolution kernel and then max pooling. The path encoding vector is obtained by dimensionality reduction through a fully connected layer. The path encoding vector is input into the path scoring network to calculate the credibility score of each path. After normalizing the credibility score, the path encoding vectors are weighted and fused to obtain the event feature vector, which is then input into the classification network to output the alarm event category.

8. A convolution-based power grid monitoring alarm event identification system, characterized by, For implementing the convolution-based power grid monitoring alarm event identification method as described in any one of claims 1-7, the convolution-based power grid monitoring alarm event identification system comprises: The acquisition module is used to acquire the electrical quantity time series data of each monitoring node in the power grid and the topological connection relationship between the nodes, and to construct a normalized adjacency matrix and a node feature matrix. The convolution module is used to perform graph convolution processing on the normalized adjacency matrix and the node feature matrix to generate a node embedding feature tensor with a fused topological structure. The filtering module is used to calculate the Euclidean distance between each node and the normal operation prototype vector based on the node embedded feature tensor to identify alarm nodes and trigger times. According to the temporal relationship of the propagation of power grid faults along electrical lines and the shortest path distance of the topology, it filters directed candidate edges that conform to the physical propagation law of the power grid and enumerates to generate a set of candidate propagation paths for alarm events. The fusion module is used to perform one-dimensional convolutional encoding and weighted fusion on the candidate propagation paths, generate event feature vectors, and output alarm event categories.

9. The system of claim 8, wherein, Obtain the time-series electrical quantities and topological connections between monitoring nodes of the power grid, and construct a normalized adjacency matrix and a node feature matrix, including: Data on three-phase voltage, three-phase current, active power, and reactive power of N monitoring nodes within a time window are collected from the power grid SCADA system to form a raw electrical quantity time series dataset. Based on the primary wiring diagram of the power grid, determine the transmission line connection relationship, transformer connection relationship and bus connection relationship between monitoring nodes, construct an undirected graph and calculate the adjacency matrix; Calculate the degree matrix of the adjacency matrix, and then perform symmetric normalization on the adjacency matrix by raising the degree matrix to the negative first power of 1 / 2 to obtain the normalized adjacency matrix. The electrical parameters of each monitoring node in the original electrical quantity time series dataset are Z-score standardized and discretized according to the time step to generate a node feature matrix.

10. The system of claim 8, wherein, Identify alarm nodes and trigger times, including: The node embedding feature tensor of each monitoring node under normal operating conditions is averaged in the time dimension to obtain the normal operating prototype vector of each node. Calculate the Euclidean distance between the embedded feature vector of each monitoring node at the current moment and the normal operation prototype vector; The Euclidean distance is compared with a preset alarm threshold. When the Euclidean distance is greater than the preset alarm threshold, the node is marked as having triggered an alarm at that moment. Extract all alarm nodes and their trigger times in chronological order to generate an alarm event sequence.

Images