A power distribution communication network distributed cloud-edge collaborative anomaly detection method and system
By employing a distributed cloud-edge collaborative anomaly detection method, a shared dataset is generated using a diffusion probability model and differential privacy constraints. Combined with local training and parameter aggregation, this approach addresses the issues of data privacy and security and insufficient model generalization ability in power distribution communication networks, achieving rapid response and efficient anomaly detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- STATE GRID FUJIAN POWER ELECTRIC CO ECONOMIC RESEARCH INSTITUTE
- Filing Date
- 2026-02-05
- Publication Date
- 2026-06-23
Smart Images
Figure CN122268613A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of power distribution communication network technology, and in particular to a method and system for detecting anomalies in distributed cloud-edge collaborative power distribution communication networks. Background Technology
[0002] As the "nerve center" of the smart grid, the distribution communication network undertakes core tasks such as equipment status monitoring, load dispatching, and distributed energy management, continuously generating massive amounts of multi-source time-series data. This data includes transformer current / voltage waveforms, photovoltaic output curves, and distribution terminal operating parameters, and is characterized by high-frequency acquisition, multi-source heterogeneity, and strong time-series correlation.
[0003] With the advancement of new power system construction, especially the significant increase in the proportion of distributed energy access and changes in electricity load characteristics, traditional periodic inspection models are no longer sufficient to meet the needs of modern power grid operation and maintenance. Timely detection of abnormal patterns in these data (such as precursors to equipment failure, communication interference, and traces of network security attacks) plays a crucial supporting role in ensuring the "safe, stable, efficient, and intelligent decision-making" of the power grid. The development of smart grids has led to the continuous expansion of power system scale and the increasing density of sensor deployment, resulting in an exponential growth trend in time series data. Taking modern substations as an example, their monitoring systems can generate thousands to tens of thousands of data points per second, forming large-scale, high-dimensional time series datasets. These data contain rich information about the operating status of the power system, but also bring unprecedented challenges to anomaly detection. In this context, efficient and accurate anomaly detection algorithms can not only promptly identify potential equipment problems and prevent fault escalation, but also provide data support for predictive maintenance, thereby significantly improving power supply reliability and operation and maintenance efficiency. Traditional centralized time series anomaly detection models expose three core dilemmas when facing the special application scenarios of distribution networks: First, regarding privacy and security, distribution data contains sensitive information such as user electricity consumption characteristics and power grid topology, and centralized uploading can easily lead to data leaks and compliance issues. Second, regarding system efficiency, the transmission of high-frequency time-series data causes a surge in bandwidth occupancy, and centralized computing in the cloud creates single-point pressure on computing power, making it difficult to meet the requirements for millisecond-level anomaly response. Finally, regarding data collaboration, the phenomenon of data silos between different distribution substations and power companies is significant, making it impossible to achieve feature fusion of cross-regional data, resulting in insufficient model generalization ability. Summary of the Invention
[0004] The technical problem to be solved by the present invention is to provide a distributed cloud-edge collaborative anomaly detection method and system for power distribution communication networks, which can effectively improve the timeliness and generalization ability of anomaly detection while ensuring data privacy.
[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A distributed cloud-edge collaborative anomaly detection method for power distribution communication networks includes: The central server constructs an anomaly detection model and generates a shared dataset based on a diffusion probability model and differential privacy constraints; The central server distributes the anomaly detection model and the shared dataset to each local client. The local client uses local time-series data and the shared dataset to train the anomaly detection model locally and updates the trainable parameters of the anomaly detection model. After local training is completed, the local client uploads the latest trainable parameters to the central server; The central server receives the latest trainable parameters from all local clients and aggregates all the latest trainable parameters to obtain the aggregated global parameters. The central server distributes the aggregated global parameters to each local client. The local client performs anomaly detection on the time series data of the power distribution communication network based on the anomaly detection model and the aggregated global parameters, and obtains anomaly scores.
[0006] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: A distributed cloud-edge collaborative anomaly detection system for power distribution communication networks includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the various steps of the aforementioned distributed cloud-edge collaborative anomaly detection method for power distribution communication networks.
[0007] The beneficial effects of this invention are as follows: To address the continuous generation of high-frequency, multi-source time-series data in power distribution communication networks, a central server constructs an anomaly detection model and generates a shared dataset based on a diffusion probability model and differential privacy constraints. This allows for the generation of high-quality shared data while protecting data privacy. The anomaly detection model and the shared dataset are then distributed to various local clients. Local clients use their local time-series data and the shared dataset to train the anomaly detection model locally, updating its trainable parameters. After local training, the latest trainable parameters are uploaded to the central server. The central server aggregates all the latest trainable parameters and distributes the aggregated global parameters to each local client. Local clients then use the anomaly detection model and the aggregated global parameters to perform anomaly detection on the time-series data of the power distribution communication network. This distributed cloud-edge collaborative architecture enables cross-regional model training and distributed anomaly detection, meeting the need for rapid anomaly response and achieving feature fusion of cross-regional data. Thus, while ensuring data privacy, it effectively improves the timeliness and generalization ability of anomaly detection. Attached Figure Description
[0008] Figure 1 This is a flowchart of a distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a distributed cloud-edge collaborative anomaly detection system for a power distribution communication network according to an embodiment of the present invention; Figure 3 This is a framework diagram of an anomaly detection model in a distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to an embodiment of the present invention. Figure 4 This is a distributed framework diagram of cloud-edge collaboration in a distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to an embodiment of the present invention. Detailed Implementation
[0009] To explain in detail the technical content, objectives, and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.
[0010] Before detailing the embodiments of this application, some related concepts will first be explained: Diffusion probability model: It is a type of generative model. Its core logic is to first gradually add noise to turn real data into pure noise, and then learn to recover real data from the noise. Differential privacy constraints: limit the impact of a single sample on model training or data generation results, ensuring that attackers cannot deduce the privacy information of any original local time series data through model output, parameters, or synthetic data.
[0011] In existing technologies, traditional centralized time series anomaly detection modes face several challenges when dealing with the special application scenarios of power distribution networks. In terms of privacy and security, centralized uploading can easily lead to data leakage and compliance issues. Furthermore, the transmission of high-frequency time series data causes a surge in bandwidth occupancy, and centralized cloud computing creates single-point pressure on computing power, making it difficult to meet the millisecond-level anomaly response requirements. At the same time, the phenomenon of data silos between different power distribution areas and power companies is significant, making it impossible to achieve feature fusion of cross-regional data, resulting in insufficient model generalization ability.
[0012] To at least solve the above problems, please refer to Figure 1 This invention provides a distributed cloud-edge collaborative anomaly detection method for power distribution communication networks, comprising: The central server constructs an anomaly detection model and generates a shared dataset based on a diffusion probability model and differential privacy constraints; The central server distributes the anomaly detection model and the shared dataset to each local client. The local client uses local time-series data and the shared dataset to train the anomaly detection model locally and updates the trainable parameters of the anomaly detection model. After local training is completed, the local client uploads the latest trainable parameters to the central server; The central server receives the latest trainable parameters from all local clients and aggregates all the latest trainable parameters to obtain the aggregated global parameters. The central server distributes the aggregated global parameters to each local client. The local client performs anomaly detection on the time series data of the power distribution communication network based on the anomaly detection model and the aggregated global parameters, and obtains anomaly scores.
[0013] As described above, the beneficial effects of this invention are as follows: For the continuous generation of high-frequency, multi-source time-series data in power distribution communication networks, a central server constructs an anomaly detection model and generates a shared dataset based on a diffusion probability model and differential privacy constraints. This allows for the generation of high-quality shared data while protecting data privacy. The anomaly detection model and the shared dataset are then distributed to various local clients. Local clients use their local time-series data and the shared dataset to train the anomaly detection model locally, updating the trainable parameters. After local training, the latest trainable parameters are uploaded to the central server. The central server aggregates all the latest trainable parameters and distributes the aggregated global parameters to each local client. Local clients then use the anomaly detection model and the aggregated global parameters to perform anomaly detection on the time-series data of the power distribution communication network. This distributed cloud-edge collaborative architecture enables cross-regional model training and distributed anomaly detection, meeting the need for rapid anomaly response and achieving feature fusion of cross-regional data. Thus, while ensuring data privacy, it effectively improves the timeliness and generalization ability of anomaly detection.
[0014] Furthermore, the central server constructs an anomaly detection model including: The central server establishes an adaptive spectrum module based on fast Fourier transform, an inter-variable related information capture module based on graph attention network, a local correlation extraction module based on adaptive multi-scale temporal convolutional network, a normalization layer, a fully connected layer, and a time series reconstruction layer. The central server obtains the anomaly detection model based on the adaptive spectrum module, the inter-variable related information capture module, the local correlation extraction module, the normalization layer, the fully connected layer, and the time series reconstruction layer; The adaptive spectrum module is used to extract frequency domain information of time series data and suppress high-frequency noise; the inter-variable related information capture module is used to capture the spatial dependence of variables; and the local correlation extraction module is used to extract features at different time scales.
[0015] As described above, the adaptive spectrum module extracts frequency domain information and suppresses high-frequency noise using fast Fourier transform, effectively filtering out invalid interference. The inter-variable related information capture module relies on graph attention network to capture the spatial dimensional dependence of variables and mine multi-dimensional correlation features. The adaptive multi-scale temporal convolutional network module can extract local correlation features at different time scales, taking into account both short-term fluctuations and long-term trends. Then, through normalization layer and fully connected layer, the efficiency of feature fusion and parameter transfer is optimized. Combined with time series reconstruction layer, anomalies are located by comparing reconstruction errors. Overall, it makes up for the limitations of single feature extraction, improves the model's ability to represent complex patterns in power distribution communication network time series data, enhances the accuracy of identifying hidden and complex anomalies, and reduces the false positive and false negative rates.
[0016] Furthermore, in the local correlation extraction module, the adaptive multi-scale temporal convolutional network... l The output features of the layer are: ; In the formula, This represents the adaptive multi-scale temporal convolutional network. l The output features of the layer Indicates the number of convolution branches. Indicates the first l Learnable branch weights of the layer This represents a one-dimensional convolution operation function, used to perform one-dimensional convolution calculations on the input. Indicates the first l Output features of layer -1 Indicates the first l Layer k Convolutional kernels for each branch, Indicates the bias term. Represents the set of expansion rates; The first l The learnable branch weights of a layer are obtained through a normalized exponential function, specifically: ; In the formula, Indicates the first l Layer k Each branch selects parameters based on a scale dynamically generated from the input features. Indicates the first l Layer j Each branch selects parameters based on a scale dynamically generated from the input features.
[0017] As described above, the adaptive multi-scale temporal convolutional network achieves accurate adaptive extraction of local correlations in time series by setting up multi-branch one-dimensional convolutions and introducing learnable branch weights. Each branch uses different dilation rates to obtain features at different time scales, taking into account both short-term fine fluctuations and long-term trend features. The learnable weights are dynamically generated based on the input features through a normalized exponential function, which can automatically adapt to the data characteristics to allocate branch weights, strengthen the contribution of effective scale features, weaken the interference of ineffective branches, and avoid the limitations of fixed-scale convolutions. At the same time, the one-dimensional convolution and dilation rate design improves computational efficiency, reduces model complexity, and allows the module to more efficiently capture local correlation features at different time granularities, providing more comprehensive and accurate temporal feature support for subsequent anomaly detection and improving the model's ability to represent complex temporal patterns.
[0018] Furthermore, the generation of shared datasets based on diffusion probability models and differential privacy constraints includes: The local client uses forward diffusion based on local time series sample data. T Gaussian noise is gradually added during the process, so that the local time series sample data is gradually transformed into an isotropic distribution, and the noisy local time series sample data is obtained. The local client constructs a noise prediction neural network; With minimizing the mean square error and maximum mean difference loss between predicted noise and real noise as the first training objective, the noise prediction neural network is trained using the differential privacy stochastic gradient descent optimization algorithm based on the noisy local time series sample data and the local time series sample data, to obtain the trained noise prediction neural network. In the generation phase, random pure Gaussian noise is constructed, and the trained noise prediction neural network is used to process the pure Gaussian noise according to... T Perform the denoising operation in reverse order to obtain a locally synthesized dataset; The local client uploads the locally synthesized dataset to the central server; The central server generates a shared dataset based on the locally synthesized dataset.
[0019] As described above, a shared dataset is generated based on the diffusion probability model and differential privacy constraints. The local client gradually adds noise through forward diffusion to transform the time series data into an isotropic distribution. Based on the noise and the original data, the noise prediction network is trained using the differential privacy stochastic gradient descent algorithm with the goal of minimizing the mean square error of noise prediction and the maximum mean difference loss. Then, local synthetic data is generated by reverse denoising with pure Gaussian noise. The shared dataset is obtained by aggregation by the central server. This process keeps the original time series data locally throughout the process. The differential privacy mechanism limits the influence of single samples through gradient noise addition, eliminating privacy leakage at the source. The generated synthetic data retains the statistical distribution and temporal structure of the real data. The central server aggregates the local synthetic data from multiple clients to further enrich the distribution diversity of the shared dataset, providing high-quality, privacy-risk-free data support for subsequent training and effectively improving the generalization ability of the global model.
[0020] Furthermore, the primary training objective is to minimize the mean square error and the maximum mean difference loss between the predicted noise and the actual noise, specifically: ; ; ; In the formula, This represents the sum of the mean square error and the maximum mean difference loss between the predicted noise and the actual noise. This represents the mean square error between the predicted noise and the actual noise. This represents a balance coefficient used to adjust the trade-off between generation accuracy and distribution alignment strength. This represents the loss due to the maximum mean difference. Indicates the original sequence Diffusion steps Real noise added The mathematical expectation, This represents a neural network for predicting noise. Represents the true data distribution In the sample The expected features after feature mapping Represents the feature map in the reproducing kernel Hilbert space. Represents the distribution of synthetic data In the sample The desired features after feature mapping.
[0021] As described above, the training objective achieves accurate training through a weighted fusion of diffusion reconstruction loss and maximum mean difference loss. Mean squared error loss guides the noise prediction neural network to accurately estimate the real noise during the noise addition process, ensuring the temporal structure accuracy of the synthetic data generated by reverse denoising. Maximum mean difference loss, with the help of regeneration kernel Hilbert spatial feature mapping, constrains the statistical feature distribution of synthetic data to align with that of real data. The balance coefficient can flexibly adjust the weights of generation accuracy and distribution consistency, avoiding the problem of synthetic data structure distortion or statistical bias caused by a single loss. This allows the local synthetic dataset generated by the trained model to retain the temporal evolution characteristics of the real time series while being highly consistent with the statistical characteristics of the real data.
[0022] Furthermore, the local client uses local time-series data and the shared dataset to train the anomaly detection model locally, and updates the trainable parameters of the anomaly detection model including: The local client uses local time-series data and the shared dataset to train the anomaly detection model locally based on a space-time dual-dimensional knowledge transfer mechanism, and updates the trainable parameters of the anomaly detection model.
[0023] As described above, by combining local data with shared datasets through a spatial-temporal dual-dimensional knowledge transfer mechanism, the anomaly detection model can simultaneously absorb the spatial variable correlations and temporal evolution patterns of multi-client time-series data in the shared dataset. This compensates for the limitations of single local data distribution and insufficient sample size. The dual-dimensional knowledge transfer can promote the model's accurate mining of spatiotemporal feature correlations in local time-series data, strengthen the model's ability to identify local anomaly patterns, and improve the model's generalization ability by leveraging the global features of the shared dataset. Local training does not require uploading original data, thus avoiding privacy risks and allowing for targeted updates to the model's trainable parameters. This makes the optimized model more suitable for the anomaly detection needs of local power distribution and communication network time-series data, effectively improving detection accuracy and efficiency.
[0024] Furthermore, the local client uses local time-series data and the shared dataset to train the anomaly detection model locally based on a space-time dual-dimensional knowledge transfer mechanism, and updates the trainable parameters of the anomaly detection model including: The local client calculates the spatial feature differences between the local anomaly detection model and the global anomaly detection model on the shared dataset; In streaming data or incremental task scenarios, the local client regards the anomaly detection model from the previous training cycle as the teacher model, guides the temporal feature learning of the current anomaly detection model, and transmits cross-node temporal experience. The local client calculates the temporal feature differences between the current anomaly detection model and the teacher model on local time series data; The local client establishes a second training objective based on the spatial feature differences, the temporal feature differences, and the reconstruction loss, and performs multiple rounds of iterative training on the anomaly detection model based on the second training objective to obtain the latest trainable parameters of the anomaly detection model.
[0025] As described above, by calculating the spatial feature differences between local and global models on a shared dataset, the correlation patterns of spatial dimension variables across multiple clients are aligned, overcoming the limitation of the single spatial feature of local data. Simultaneously, the previous cycle model is used as a teacher model to guide the current model, transferring cross-node temporal experience. Combined with local data, temporal feature differences are calculated to ensure the model's accurate learning of local temporal patterns. Furthermore, the spatial and temporal feature differences are integrated with reconstruction loss to construct training objectives, allowing the model to simultaneously master global common spatiotemporal features and local unique anomaly patterns. Efficient local training can be achieved without uploading original data, avoiding privacy risks and improving the model's adaptability and generalization ability in streaming or incremental task scenarios, significantly reducing the false negative and false positive rates of anomaly detection.
[0026] Furthermore, the local client calculates the spatial feature differences between the local anomaly detection model and the global anomaly detection model on the shared dataset, specifically as follows: ; In the formula, Represents spatial knowledge transfer. This represents the feature representation output by the local anomaly detection model. This represents the feature representation output by the global anomaly detection model. Indicates a shared dataset; The local client calculates the temporal feature differences between the current anomaly detection model and the teacher model on local time series data, specifically as follows: ; In the formula, This indicates the transfer of knowledge over time. This represents the feature representation output by the teacher model. This represents the feature representation output by the current anomaly detection model. Indicates local client Local time series data; The local client establishes a second training objective based on the spatial feature differences, the temporal feature differences, and the reconstruction loss, specifically as follows: ; In the formula, This indicates the second training objective. Indicates the losses incurred during reconstruction. This represents the first weighting coefficient. This represents the second weighting coefficient.
[0027] As described above, the training objective achieves accurate local optimization of the anomaly detection model by fusing reconstruction loss, spatial feature difference loss, and temporal feature difference loss. Spatial feature difference loss aligns the spatial feature representations of the local and global models based on a shared dataset, allowing the local model to absorb the correlation patterns of global spatial variables from multiple clients and compensate for the limitations of local data spatial features. Temporal feature difference loss leverages the teacher model to transmit cross-node temporal experience, constraining the temporal feature learning direction of the current model and ensuring the stable inheritance and optimization of local temporal patterns. Reconstruction loss ensures the model's accurate representation and reconstruction capabilities of temporal data, thus enabling the locally trained model to possess both global generalization ability and precise adaptation to the temporal data characteristics of the local power distribution communication network, improving the accuracy and adaptability of anomaly detection.
[0028] Furthermore, all the latest trainable parameters are aggregated to obtain the aggregated global parameters, specifically: ; In the formula, This represents the aggregated global parameters. Indicates the number of local clients. Indicates local client Local time series data, Indicates local client In the The latest trainable parameters after one round of training.
[0029] As described above, aggregating the trainable parameters of all clients allows parameters from clients with larger datasets to contribute higher weights to the global model. This is because the data from these clients typically contains more comprehensive temporal features and anomaly patterns, improving the representation effectiveness of the global parameters. At the same time, it takes into account the local features of clients with smaller datasets, avoiding global parameter bias caused by a single client dominance or average weighting. This enhances the adaptability of the global model to different client scenarios. Multi-client parameter collaborative optimization can be achieved without uploading the original data, ensuring data privacy. Furthermore, by integrating the spatiotemporal feature learning experience of multiple nodes through weighted aggregation, it improves the generalization ability and detection accuracy of the global anomaly detection model.
[0030] Please refer to Figure 2 Another embodiment of the present invention provides a distributed cloud-edge collaborative anomaly detection system for power distribution communication networks, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the various steps of the above-described distributed cloud-edge collaborative anomaly detection method for power distribution communication networks.
[0031] The distributed cloud-edge collaborative anomaly detection method and system for power distribution communication networks described above are applicable to anomaly detection scenarios in power distribution communication networks. The specific implementation methods are described below: Please refer to Figure 1 One embodiment of the present invention is as follows: A distributed cloud-edge collaborative anomaly detection method for power distribution communication networks includes: S1. The central server constructs an anomaly detection model and generates a shared dataset based on the diffusion probability model and differential privacy constraints, specifically including S11-S18: S11. The central server establishes an adaptive spectrum module based on fast Fourier transform, an inter-variable related information capture module based on graph attention network, a local correlation extraction module based on adaptive multi-scale temporal convolutional network, a normalization layer, a fully connected layer, and a time series reconstruction layer. S12. The central server obtains an anomaly detection model based on the adaptive spectrum module, the inter-variable related information capture module, the local correlation extraction module, the normalization layer, the fully connected layer, and the time series reconstruction layer. The adaptive spectrum module is used to extract frequency domain information of time series data and suppress high-frequency noise; the inter-variable related information capture module is used to capture the spatial dependence of variables; and the local correlation extraction module is used to extract features at different time scales.
[0032] In the adaptive spectrum module, for a given time series data, a Fast Fourier Transform (FFT) is performed along the feature dimension to obtain the frequency domain representation of the sequence. In this process, the length of the transformed frequency domain information is denoted as... ,for The length of the original time series data, the length of the transformed frequency domain information The frequency domain representation is determined by the implementation method of the Fast Fourier Transform (FFT) and the characteristics of the input data. It represents the number of positive frequency components in the frequency domain and includes all important frequency information, including zero-frequency components. Each feature dimension of the time series data is independently Fourier transformed to obtain its frequency domain representation. By independently transforming all features, a comprehensive frequency domain representation is ultimately formed. ; In the formula, Frequency domain representation of time series data Represents the Fast Fourier Transform. Indicates the transformed feature dimension. This represents time series data.
[0033] In real-world time-series data, true signals typically exhibit high power within certain frequency ranges, and these frequency components often correspond to the main characteristics and patterns of the data. In contrast, high-frequency noise, although occupying higher frequencies in the frequency domain, usually has lower power and is random and irregular; therefore, these components are generally considered secondary interference signals. To effectively distinguish between these useful signals and noise, a dynamic threshold strategy is adopted, adaptively adjusting the filtering criteria based on spectral characteristics. Specifically, power spectrum analysis is first performed on the frequency domain representation of the time-series data to calculate the power of each frequency component. Specifically: ; Based on this, after normalizing the frequency domain power of each feature variable, an adaptive threshold mask is generated by combining it with trainable threshold parameters, specifically: ; ; In the formula, Indicates an adaptive threshold mask. This is an indicator function that returns 1 if the condition is true, and 0 otherwise. Indicates the first The power vector after feature normalization Indicates the first Trainable threshold parameters corresponding to each feature This represents the filtered frequency domain representation. This indicates element-wise multiplication.
[0034] After applying dynamic threshold filtering to the frequency domain data, two learnable weight parameters are used to further enhance the representation of frequency domain information. The first is a global weight parameter. The first step is to weight the original signal to preserve the overall context and prevent the loss of potentially important global information due to over-filtering; the second step is to use local weight parameters. It focuses on learning from data after dynamic threshold filtering, amplifying high-power, key information to highlight useful features. By combining these two weighting methods, the expressive power of frequency domain signals can be effectively improved, as follows: ; ; ; In the formula, This represents the frequency domain features after local weighting (local enhancement). This represents the frequency domain features after global weighting (preserving the overall context). This represents the integrated frequency domain information.
[0035] Finally, after integrating local and global information, the inverse Fourier transform (IFFT) is used to convert the frequency domain signal back to the time domain, ensuring that the enhanced features remain consistent with the original data structure of the input time series, thereby recovering a more accurate time domain signal. Specifically: ; In the formula, This represents time series data after noise suppression and enhancement of the useful signal. Indicates the inverse Fourier transform. This represents the feature dimension after restoration.
[0036] In the variable-related information capture module, to effectively capture the complex dependencies between variables in the spatial dimension, a graph structure representation method based on nodes and edges is constructed. Nodes correspond to various feature variables, and edges describe the interaction strength between features. Regarding similarity measurement, a dynamic time warping method is used to evaluate the morphological similarity of different time series. Based on the dynamic time warping similarity measurement, the adjacency matrix of the graph is constructed in the following way: ; ; In the formula, This represents the final distance between time series data after processing. This indicates that the normalized distance between the two is calculated after performing dynamic time warping. Represents a node i Time series representation, Represents a node j Time series representation, Represents the normalization coefficient. This represents a preset threshold; if the distance between nodes is less than this threshold, the node is considered a node. i With nodes j There are connecting edges between them. This represents the adjacency matrix.
[0037] A Graph Attention Network (GAT) is used to model the learned graph topology. By fusing information from neighboring nodes to update the representation of each node, the model's ability to characterize complex relationships is improved. The core task of the GAT is to calculate the attention coefficients between nodes, which determine the attention of each node. i Its neighboring nodes j The weight of information passed between them. Given a set of... N A graph with 10 nodes, i.e. , Represented as nodes in the graph i The vector, which is a feature sequence. i =1,2,…, n The graph attention network layer generates an aggregated representation for each node, specifically: ; In the formula, This represents the output after aggregating neighbor node information. This represents the sigmoid activation function. Nodes are obtained by representing the graph structure. i The neighboring nodes, Indicates the node used for measurement j For nodes iContribution to attention coefficient Represented as nodes in the graph j The vector.
[0038] Attention coefficient Calculated using the following formula: ; ; In the formula, Represents a node For nodes Unnormalized attention score A vector representing the learnable coefficients of the attention mechanism. This represents a connection between two nodes. Represents a node For nodes The unnormalized attention score. Using LeakyReLU Attention coefficients are calculated as a nonlinear activation function, and the attention coefficients are normalized using a normalized exponential function.
[0039] After processing by a graph attention network, the node update features are obtained. It aggregates the spatial information of neighboring nodes. Since the model processes multidimensional time series, the graph attention network shares parameters and computes independently at each time step on the time axis. Therefore, the output features of all nodes constitute a three-dimensional tensor. This tensor fully preserves the temporal dimension and captures the dynamic graph structure information at each time step. To adapt to subsequent adaptive multi-scale temporal convolutional networks and fuse spatial features, it is necessary to convert the discrete node dimensions... With feature dimension This is then integrated. A linear embedding layer maps the spatial features of each time step to the hidden layer dimension of the model. Specifically: ; In the formula, This indicates the output embedding representation. This represents the embedding function, and this transformation can provide richer feature representations for subsequent tasks and enhance the model's ability to learn complex patterns.
[0040] In anomaly detection tasks in power distribution communication networks, time series data often simultaneously contain short-term sudden fluctuations (such as link interruptions and jitter) and long-term evolutionary trends (such as channel attenuation and equipment aging). Therefore, in the local correlation extraction module, an adaptive multi-scale temporal convolutional network structure is proposed. Through a multi-branch temporal receptive field fusion mechanism, features are dynamically extracted at different time scales, achieving unified modeling of multiple anomalies. The adaptive multi-scale temporal convolutional network in the local correlation extraction module... l The output features of the layer are: ; In the formula, This represents the adaptive multi-scale temporal convolutional network. l The output features of the layer Indicates the number of convolution branches. Indicates the first l Learnable branch weights of the layer This represents a one-dimensional convolution operation function, used to perform one-dimensional convolution calculations on the input. Indicates the first l Output features of layer -1 Indicates the first l Layer k Convolutional kernels for each branch, Indicates the bias term. Represents the set of expansion rates; The first l The learnable branch weights of a layer are obtained through a normalized exponential function, specifically: ; In the formula, Indicates the first l Layer k Each branch selects parameters based on a scale dynamically generated from the input features. Indicates the first l Layer j Each branch selects parameters based on a scale dynamically generated from the input features.
[0041] The convolution operation uses causal convolution, meaning it depends only on the input from past time steps, specifically: ; In the formula, Indicates causal convolution at time... The output characteristics, The convolution kernel is represented by the first... One weight parameter, This indicates that the input time series data is at time [time]. The value of , This indicates the kernel size.
[0042] The design of causal convolution guarantees temporal directionality, while dilated convolution can exponentially expand the receptive field while maintaining the same computational cost. Its effective receptive field is: ; In the formula, This represents the effective receptive field of dilated convolution. Indicates the number of network layers. Indicates the first The expansion rate used in the layer.
[0043] The output feature matrix of the adaptive multi-scale temporal convolutional network structure and the embedding representation after graph attention network encoding Residual connections and normalization operations are performed, and then the fully connected layer and the time series reconstruction layer are used to capture the feature representation of the sequence more comprehensively, resulting in the reconstructed time series. R Specifically: ; In the formula, Indicates a fully connected layer. The representation layer normalization operation is used. Residual connections aim to mitigate the vanishing and exploding gradient problems, thereby enabling the model to be trained at deeper network layers. The mean squared error (MSE) between the reconstructed output and the observed values is used as the loss function to calculate the reconstruction loss.
[0044] S13, The local client uses forward diffusion based on local time series sample data. T Gaussian noise is gradually added during the process to gradually transform the local time series sample data into an isotropic distribution, resulting in noisy local time series sample data.
[0045] Specifically, the local time series sample data is gradually transformed into an isotropic distribution, which involves: ; In the formula, This indicates that the forward diffusion (noise addition) process is in the first... The conditional probability distribution of the step. Represents a multivariate normal distribution. Indicates the first The sample after adding noise in the step, Indicates the first The sample after adding noise in the step, This represents the noise scheduling coefficient, which controls the intensity of the disturbance at each step. This represents the identity matrix, used to construct the covariance matrix and ensure that noise in each dimension is independent.
[0046] S14. The local client constructs a noise prediction neural network.
[0047] S15. With minimizing the mean square error and maximum mean difference loss between the predicted noise and the real noise as the first training objective, the noise prediction neural network is trained using the differential privacy stochastic gradient descent (DP-SGD) optimization algorithm based on the noisy local time series sample data and the local time series sample data to obtain the trained noise prediction neural network.
[0048] The primary training objective is to minimize the mean square error and the maximum mean difference loss between the predicted and actual noise. ; ; ; In the formula, This represents the sum of the mean square error and the maximum mean difference loss between the predicted noise and the actual noise. This represents the mean square error between the predicted noise and the actual noise. This represents a balance coefficient used to adjust the trade-off between generation accuracy and distribution alignment strength. This represents the loss due to the maximum mean difference. Indicates the original sequence Diffusion steps Real noise added The mathematical expectation, This represents a neural network for predicting noise. Represents the true data distribution In the sample The expected features after feature mapping Represents the feature map in the reproducing kernel Hilbert space. Represents the distribution of synthetic data In the sample The desired features after feature mapping.
[0049] Random noise is added to the gradient with each parameter update, specifically as follows: ; In the formula, This represents the gradient after adding noise. Indicates batch size. Represents model parameters gradient operator, The loss function is represented at the th... The values on each sample This represents noise intensity and is used to control the level of privacy protection. The process theoretically satisfies... Differential privacy constraints can effectively limit the impact of individual samples on global parameters. To stabilize training and avoid convergence oscillations caused by privacy noise, the model employs both learning rate decay and mini-batch resampling strategies, causing the generated distribution to stabilize in the later stages of training.
[0050] S16. In the generation stage, random pure Gaussian noise is constructed, and the trained noise prediction neural network is used to process the pure Gaussian noise according to... T Perform the denoising operation in reverse order to obtain a locally synthesized dataset.
[0051] Specifically, the noise term is estimated using the trained noise prediction neural network, and then backsampled to perform the denoising operation, as follows: ; In the formula, This indicates that the back diffusion (denoising) process is in the first... The conditional probability distribution of the step. This represents the mean estimated by the noise prediction neural network. The covariance matrix represents the inverse process and controls the distribution variance characteristics during denoising. This denoising process ensures that the model learns the underlying time-dependent dynamics, thereby generating samples with temporal consistency.
[0052] S17. The local client uploads the locally synthesized dataset to the central server.
[0053] S18. The central server generates a shared dataset based on the locally synthesized dataset, specifically as follows: ; In the formula, Indicates the number of local clients. Indicates the first i A local synthetic dataset for a local client.
[0054] To reduce communication overhead in power distribution communication networks and meet data security requirements, a distributed learning and training strategy based on efficient parameter aggregation is designed. This strategy combines knowledge sharing of the global model with personalized modeling of local data to achieve collaborative optimization of spatiotemporal anomaly detection under privacy protection, as detailed below.
[0055] S2. The central server distributes the anomaly detection model and the shared dataset to each local client.
[0056] S3, the local client uses local time-series data (i.e. Figure 4 The anomaly detection model is trained locally using the private dataset and the shared dataset, and the trainable parameters of the anomaly detection model are updated.
[0057] Specifically, the local client uses local time-series data and the shared dataset to train the anomaly detection model locally based on a space-time dual-dimensional knowledge transfer mechanism, and updates the trainable parameters of the anomaly detection model, specifically including S31-S34: S31. The local client calculates the spatial feature differences between the local anomaly detection model and the global anomaly detection model on the shared dataset, specifically as follows: ; In the formula, This approach represents knowledge transfer and encourages consistency in the implicit representation spaces of different clients, reducing model shifts caused by differences in data distribution. This represents the feature representation output by the local anomaly detection model. This represents the feature representation output by the global anomaly detection model. This indicates a shared dataset.
[0058] In scenarios such as S32, streaming data, or incremental tasks, the local client treats the anomaly detection model from the previous training cycle as the teacher model, guides the temporal feature learning of the current anomaly detection model, and transmits cross-node temporal experience.
[0059] S33. The local client calculates the temporal feature differences between the current anomaly detection model and the teacher model on local time series data, specifically as follows: ; In the formula, This represents temporal knowledge transfer, using soft label constraints to enable the model to retain memories of old patterns when learning new data, thereby mitigating "concept drift" and "catastrophic forgetting". This represents the feature representation output by the teacher model. This represents the feature representation output by the current anomaly detection model. Indicates local client Local time series data.
[0060] S34. The local client establishes a second training objective based on the spatial feature difference, the temporal feature difference, and the reconstruction loss, and performs multiple rounds of iterative training on the anomaly detection model based on the second training objective to obtain the latest trainable parameters of the anomaly detection model.
[0061] Specifically, the local client establishes a second training objective based on the spatial feature differences, the temporal feature differences, and the reconstruction loss, as follows: ; In the formula, This indicates the second training objective. Indicates the losses incurred during reconstruction. This represents the first weighting coefficient. This represents the second weighting coefficient.
[0062] S4. After local training is completed, the local client uploads the latest trainable parameters to the central server.
[0063] S5. The central server receives the latest trainable parameters from all local clients and aggregates all the latest trainable parameters to obtain the aggregated global parameters, specifically: ; In the formula, This represents the aggregated global parameters. Indicates the number of local clients. Indicates local client Local time series data, Indicates local client In the The latest trainable parameters after one round of training.
[0064] S6. The central server distributes the aggregated global parameters to each local client.
[0065] The aggregated global parameters can be used for the next round of local updates until the global loss converges or the maximum number of communication rounds is reached.
[0066] S7. The local client performs anomaly detection on the time series data of the power distribution communication network based on the anomaly detection model and the aggregated global parameters, and obtains anomaly scores.
[0067] Specifically, the local client updates the anomaly detection model using the aggregated global parameters, and then uses the latest anomaly detection model to perform anomaly detection on the input time-series data of the power distribution communication network. During the anomaly detection process, the time-series data is reconstructed to obtain a reconstructed sequence, and an anomaly score is calculated based on the reconstruction error. ; In the formula, Indicates abnormal scores. Indicates the first t The first time step i 3D eigenvalues Indicates the first t The first time step i 3D reconstruction of eigenvalues.
[0068] According to another aspect of the invention, Figure 2This is a schematic diagram illustrating a distributed cloud-edge collaborative anomaly detection system for a power distribution communication network according to an embodiment of the present invention. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the various steps of the distributed cloud-edge collaborative anomaly detection method for a power distribution communication network as described above.
[0069] In summary, this invention discloses a distributed cloud-edge collaborative anomaly detection method and system for power distribution communication networks. Addressing the challenges of traditional centralized anomaly detection methods, which continuously generate high-frequency, multi-source time-series data in power distribution communication networks, including privacy and security risks, insufficient system efficiency, and difficulties in cross-domain data collaboration, this invention proposes a time-series data synthesis method based on a diffusion probability model and differential privacy constraints. This method generates high-quality shared data while protecting data privacy. A two-dimensional knowledge transfer mechanism is constructed, mitigating model bias and catastrophic forgetting caused by data heterogeneity through spatial knowledge alignment and temporal knowledge transfer. Relying on a distributed cloud-edge collaborative architecture, cross-regional distributed anomaly detection is achieved. This method effectively improves the timeliness and generalization ability of anomaly detection while ensuring data privacy, providing technical support for the safe and efficient operation and maintenance of smart grid power distribution communication networks.
[0070] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.
Claims
1. A method for detecting anomalies in a distributed cloud-edge collaborative power distribution communication network, characterized in that, include: The central server constructs an anomaly detection model and generates a shared dataset based on a diffusion probability model and differential privacy constraints; The central server distributes the anomaly detection model and the shared dataset to each local client. The local client uses local time-series data and the shared dataset to train the anomaly detection model locally and updates the trainable parameters of the anomaly detection model. After local training is completed, the local client uploads the latest trainable parameters to the central server; The central server receives the latest trainable parameters from all local clients and aggregates all the latest trainable parameters to obtain the aggregated global parameters. The central server distributes the aggregated global parameters to each local client. The local client performs anomaly detection on the time series data of the power distribution communication network based on the anomaly detection model and the aggregated global parameters, and obtains anomaly scores.
2. The distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to claim 1, characterized in that, The central server constructs an anomaly detection model including: The central server establishes an adaptive spectrum module based on fast Fourier transform, an inter-variable related information capture module based on graph attention network, a local correlation extraction module based on adaptive multi-scale temporal convolutional network, a normalization layer, a fully connected layer, and a time series reconstruction layer. The central server obtains the anomaly detection model based on the adaptive spectrum module, the inter-variable related information capture module, the local correlation extraction module, the normalization layer, the fully connected layer, and the time series reconstruction layer; The adaptive spectrum module is used to extract frequency domain information of time series data and suppress high-frequency noise; the inter-variable related information capture module is used to capture the spatial dependence of variables; and the local correlation extraction module is used to extract features at different time scales.
3. The distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to claim 2, characterized in that, The adaptive multi-scale temporal convolutional network in the local correlation extraction module l The output features of the layer are: ； In the formula, This represents the adaptive multi-scale temporal convolutional network. l The output features of the layer Indicates the number of convolution branches. Indicates the first l Learnable branch weights of the layer This represents a one-dimensional convolution operation function, used to perform one-dimensional convolution calculations on the input. Indicates the first l Output features of layer -1 Indicates the first l Layer k Convolutional kernels for each branch, Indicates the bias term. Represents the set of expansion rates; The first l The learnable branch weights of a layer are obtained through a normalized exponential function, specifically: ； In the formula, Indicates the first l Layer k Each branch selects parameters based on a scale dynamically generated from the input features. Indicates the first l Layer j Each branch selects parameters based on a scale dynamically generated from the input features.
4. The distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to claim 1, characterized in that, The shared dataset generated based on the diffusion probability model and differential privacy constraints includes: The local client uses forward diffusion based on local time series sample data. T Gaussian noise is gradually added during the process, so that the local time series sample data is gradually transformed into an isotropic distribution, and the noisy local time series sample data is obtained. The local client constructs a noise prediction neural network; With minimizing the mean square error and maximum mean difference loss between predicted noise and real noise as the first training objective, the noise prediction neural network is trained using the differential privacy stochastic gradient descent optimization algorithm based on the noisy local time series sample data and the local time series sample data, to obtain the trained noise prediction neural network. In the generation phase, random pure Gaussian noise is constructed, and the trained noise prediction neural network is used to process the pure Gaussian noise according to... T Perform the denoising operation in reverse order to obtain a locally synthesized dataset; The local client uploads the locally synthesized dataset to the central server; The central server generates a shared dataset based on the locally synthesized dataset.
5. The distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to claim 4, characterized in that, The primary training objective is to minimize the mean square error and the maximum mean difference loss between the predicted and actual noise. ； ； ； In the formula, This represents the sum of the mean square error and the maximum mean difference loss between the predicted noise and the actual noise. This represents the mean square error between the predicted noise and the actual noise. This represents a balance coefficient used to adjust the trade-off between generation accuracy and distribution alignment strength. This represents the loss due to the maximum mean difference. Indicates the original sequence Diffusion steps Real noise added The mathematical expectation, This represents a neural network for predicting noise. Represents the true data distribution In the sample The expected features after feature mapping Represents the feature map in the reproducing kernel Hilbert space. Represents the distribution of synthetic data In the sample The desired features after feature mapping.
6. The distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to claim 1, characterized in that, The local client uses local time-series data and the shared dataset to train the anomaly detection model locally, and updates the trainable parameters of the anomaly detection model including: The local client uses local time-series data and the shared dataset to train the anomaly detection model locally based on a space-time dual-dimensional knowledge transfer mechanism, and updates the trainable parameters of the anomaly detection model.
7. The distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to claim 6, characterized in that, The local client uses local time-series data and the shared dataset to train the anomaly detection model locally based on a space-time dual-dimensional knowledge transfer mechanism, and updates the trainable parameters of the anomaly detection model including: The local client calculates the spatial feature differences between the local anomaly detection model and the global anomaly detection model on the shared dataset; In streaming data or incremental task scenarios, the local client regards the anomaly detection model from the previous training cycle as the teacher model, guides the temporal feature learning of the current anomaly detection model, and transmits cross-node temporal experience. The local client calculates the temporal feature differences between the current anomaly detection model and the teacher model on local time series data; The local client establishes a second training objective based on the spatial feature differences, the temporal feature differences, and the reconstruction loss, and performs multiple rounds of iterative training on the anomaly detection model based on the second training objective to obtain the latest trainable parameters of the anomaly detection model.
8. The distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to claim 7, characterized in that, The local client calculates the spatial feature differences between the local anomaly detection model and the global anomaly detection model on the shared dataset, specifically as follows: ； In the formula, Represents spatial knowledge transfer. This represents the feature representation output by the local anomaly detection model. This represents the feature representation output by the global anomaly detection model. Indicates a shared dataset; The local client calculates the temporal feature differences between the current anomaly detection model and the teacher model on local time series data, specifically as follows: ； In the formula, This indicates the transfer of knowledge over time. This represents the feature representation output by the teacher model. This represents the feature representation output by the current anomaly detection model. Indicates local client Local time series data; The local client establishes a second training objective based on the spatial feature differences, the temporal feature differences, and the reconstruction loss, specifically as follows: ； In the formula, This indicates the second training objective. Indicates the losses incurred during reconstruction. This represents the first weighting coefficient. This represents the second weighting coefficient.
9. A distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to claim 8, characterized in that, We aggregate all the latest trainable parameters to obtain the aggregated global parameters, specifically: ； In the formula, This represents the aggregated global parameters. Indicates the number of local clients. Indicates local client Local time series data, Indicates local client In the The latest trainable parameters after one round of training.
10. A distributed cloud-edge collaborative anomaly detection system for a power distribution communication network, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements each step of the distributed cloud-edge collaborative anomaly detection method for power distribution communication networks according to any one of claims 1 to 9.