A method, device and equipment for constructing a feature extraction model of multi-source service data of a power system

Abstract

This invention relates to the field of power data processing technology, and provides a method, apparatus, and equipment for constructing a feature extraction model for multi-source business data of a power system. The method includes: preprocessing acquired multi-source business data samples to obtain a standardized dataset; constructing a feature extraction rule library based on power business logic, including static structural feature extraction rules, dynamic behavioral feature extraction rules, and business semantic feature extraction rules; extracting multi-dimensional features from the standardized dataset according to the feature extraction rule library to form an initial feature set; filtering the initial feature set to remove redundant and invalid features to obtain a core feature subset; using an attention mechanism to fuse the features in the core feature subset; and semantically encapsulating the fused features to output a target feature set, thus completing the construction of the feature extraction model. This effectively improves the efficiency and automation level of feature extraction.

Description

Technical Field

[0001] This invention relates to the field of power data processing technology, and in particular to a method, apparatus and equipment for constructing a feature extraction model for multi-source business data of a power system. Background Technology

[0002] In the field of power system operation monitoring and analysis, multi-source business data is fundamental for tasks such as equipment status assessment, operational behavior analysis, and anomaly detection. Data sources in power systems are diverse, including dispatch automation logs, substation control commands, industrial protocol communication messages, equipment status monitoring data, and safety alarm records. These data vary significantly in format, semantics, and temporal granularity. Traditional feature extraction methods for power data typically begin by collecting and cleaning various types of raw data. Then, based on statistical analysis methods or signal processing techniques, statistical features such as mean, variance, and frequency are extracted from time-series data, while surface features such as keyword frequency are extracted from text data. Finally, dimensionality reduction methods such as correlation analysis are used to filter out some features, forming a feature set for subsequent equipment status identification.

[0003] Faced with the massive, high-speed, and heterogeneous data environment of power systems, existing technologies, primarily driven by manual processes, cannot automate the process. This results in time-consuming and labor-intensive feature extraction processes that struggle to adapt to the dynamic growth of data. Power business data exhibits strong domain logic and security regulations, while general feature extraction methods can only extract superficial statistical features such as mean, variance, and frequency. These methods fail to deeply integrate multi-dimensional business semantics, including scheduling processes, equipment correlations, and operational compliance, leading to weak correlation between extracted features and actual business risks and attack intentions. Furthermore, the passive selection using single statistical indicators in the feature screening stage lacks a multi-dimensional quantitative screening process that integrates business relevance, statistical significance, and model importance. This results in a large number of redundant, invalid, and even noisy features in the feature set, which not only interferes with model learning but also reduces the accuracy and generalization ability of the feature set. Consequently, practical applications suffer from low feature extraction efficiency, poor accuracy, and insufficient interpretability. Summary of the Invention

[0004] This invention provides a method, apparatus, and equipment for constructing a feature extraction model for multi-source business data in a power system, which addresses the problems of low feature extraction efficiency, poor accuracy, and insufficient interpretability in practical applications.

[0005] The first aspect of this invention provides a method for constructing a feature extraction model for multi-source business data of a power system, comprising: Acquire multi-source business data samples from the power system, wherein the multi-source business data samples include text data, numerical data, and protocol data; The multi-source business data samples are preprocessed to obtain a standardized dataset; A feature extraction rule base is constructed based on power business logic. The feature extraction rule base includes static structural feature extraction rules, dynamic behavioral feature extraction rules, and business semantic feature extraction rules. Based on the feature extraction rule base, multi-dimensional features are extracted from the standardized dataset to form an initial feature set; The initial feature set is subjected to feature filtering to remove redundant and invalid features, resulting in a core feature subset; An attention mechanism is used to fuse the features in the core feature subset, and the fused features are semantically encapsulated to output the target feature set, thus completing the construction of the feature extraction model.

[0006] Furthermore, the step of preprocessing the multi-source business data samples to obtain a standardized dataset includes: Data cleaning is performed on the multi-source business data samples, including identifying and correcting outliers using statistical criteria, filling in missing data, and removing duplicate data. The cleaned data is standardized, including normalizing numerical data, vectorizing text data, and parsing key fields of protocol data and normalizing them to obtain a standardized dataset.

[0007] Furthermore, the static structural feature extraction rules include: calculating device correlation based on the adjacency matrix between devices; calculating permission level features based on the permission level model; and calculating node importance based on the call frequency of business process nodes.

[0008] Furthermore, the dynamic behavior feature extraction rules include: extracting statistical features based on time-series data, including event frequency, mean, variance, and latency fluctuations; extracting state transition probability features based on state transition sequences using a Markov chain model; and extracting interaction strength and interaction success rate based on protocol interaction data.

[0009] Furthermore, the business semantic feature extraction rules include: combining a power industry dictionary, using the word frequency-inverse document frequency algorithm to calculate the semantic weights of keywords in the text data, and constructing a semantic feature vector.

[0010] Furthermore, the step of extracting multi-dimensional features from the standardized dataset according to the feature extraction rule base to form an initial feature set includes: Based on the static structural feature extraction rules, the device correlation degree is calculated based on the device adjacency matrix, the permission features are quantified based on the permission hierarchy model, and the node importance is calculated based on the call frequency of business process nodes to generate static structural features. According to the dynamic behavior feature extraction rules, event frequency, mean, variance and delay fluctuation features are extracted from time series data, state transition probability features are extracted based on state transition sequences using a Markov chain model, and interaction strength and interaction success rate features are extracted from protocol interaction data to generate dynamic behavior features. Based on the business semantic feature extraction rules, and combined with the power industry dictionary, the semantic weights of keywords in the text data are calculated using the word frequency-inverse document frequency algorithm to generate business semantic features; The static structural features, dynamic behavioral features, and business semantic features are combined to form an initial feature set.

[0011] Furthermore, the initial feature set is subjected to feature filtering to remove redundant and invalid features, resulting in a core feature subset, including: Redundancy analysis is performed on the features in the initial feature set. For numerical features, the correlation between features is calculated, and for discrete features, the mutual information between features is calculated. Features with mutual information exceeding a preset threshold are identified as redundant features. Among the redundant feature pairs, features with a high degree of relevance to power business are retained, and the remaining redundant features are eliminated. The validity of the feature set after removing redundant features is verified. The contribution of each feature to the power business objective is calculated by a machine learning model as the feature importance. Features with a feature importance lower than a preset threshold are judged as invalid features and removed, thus obtaining the core feature subset.

[0012] Furthermore, the fusion of features in the core feature subset using an attention mechanism includes: Calculate the attention score for each feature in the core feature subset, whereby the attention score is determined based on the feature itself and its corresponding business semantic vector; The attention weight for each feature is calculated using a normalized exponential function based on the attention score. Based on the attention weights, the features in the core feature subset are weighted and summed to generate a fused feature vector; To address the dimensional differences between heterogeneous features, a feature cross-network is used to unify the dimensions of the fused feature vector.

[0013] A second aspect of the present invention provides an apparatus for constructing a feature extraction model for multi-source business data of a power system, comprising: A multi-source business data sample acquisition module is used to acquire multi-source business data samples of the power system, wherein the multi-source business data samples include text data, numerical data and protocol data; The standardized dataset determination module is used to preprocess the multi-source business data samples to obtain a standardized dataset. The feature extraction rule base construction module is used to construct a feature extraction rule base based on power business logic. The feature extraction rule base includes static structural feature extraction rules, dynamic behavioral feature extraction rules, and business semantic feature extraction rules. The initial feature set determination module is used to extract multi-dimensional features from the standardized dataset according to the feature extraction rule base to form an initial feature set; The core feature subset determination module is used to perform feature filtering on the initial feature set, remove redundant and invalid features, and obtain the core feature subset; The target feature set output module is used to fuse the features in the core feature subset using an attention mechanism, and to semantically encapsulate the fused features to output the target feature set, thus completing the construction of the feature extraction model.

[0014] A third aspect of the present invention provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the method for constructing a feature extraction model for multi-source business data of a power system as described above.

[0015] As can be seen from the above technical solutions, the present invention has the following advantages: This invention preprocesses multi-source business data samples to obtain a standardized dataset. Based on power business logic, a feature extraction rule library is constructed, comprising static structural feature extraction rules, dynamic behavioral feature extraction rules, and business semantic feature extraction rules. Multi-dimensional features are extracted from the standardized dataset according to the feature extraction rule library to form an initial feature set. Redundant and invalid features are removed from the initial feature set to obtain a core feature subset. An attention mechanism is used to fuse the features in the core feature subset, and the fused features are semantically encapsulated to output the target feature set, thus completing the construction of the feature extraction model. This invention, by constructing a feature extraction rule library that integrates power business logic, achieves automated extraction of structured, behavioral, and semantic multi-dimensional features strongly correlated with business risks from multi-source heterogeneous data, significantly improving the efficiency and automation level of feature extraction. By removing redundant and invalid features through feature filtering, the feature dimensionality is reduced and noise interference is minimized, improving the quality of the feature set and the accuracy of subsequent modeling. The attention mechanism enables deep fusion of heterogeneous features, and the semantic encapsulation imparts interpretability to the features, enhancing their expressive power and business adaptability. Attached Figure Description

[0016] Figure 1 This is a schematic flowchart of an embodiment of a method for constructing a feature extraction model for multi-source business data in a power system according to the present invention; Figure 2This is a schematic diagram of the process for forming the initial feature set in this invention; Figure 3 This is a schematic diagram of the process for outputting the target feature set in this invention. Detailed Implementation

[0017] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “corresponding to,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0018] Example 1 The implementation method in this embodiment can be implemented in a system, on a server, or on a terminal; no specific limitation is made. The method in this application will be described below from the perspective of system implementation. Please refer to... Figure 1 The method provided in this application includes the following steps: S1. Obtain multi-source business data samples from the power system. These multi-source business data samples include text data, numerical data, and protocol data. Specifically, multi-source business data samples are collected from various business units within the power system. These include: text data such as power dispatch automation system operation logs, substation equipment operation records, safety alarm text messages, maintenance records, and work order reports; numerical data such as telemetry data from power equipment status monitoring, voltage and current electrical quantity measurements, active and reactive power data, switch opening and closing status quantities, and frequency and phase data; and protocol data such as communication message data based on the IEC 60870-5-104 protocol, Modbus TCP protocol, IEC 61850 protocol, and DNP3.0 distributed network protocol, as well as dispatch automation system control commands, remote control commands, remote adjustment commands, and parameter setting commands. These multi-source business data samples are acquired through standardized data acquisition interfaces deployed in the power monitoring system, data acquisition and monitoring control system, substation automation system, and network security monitoring platform. During the acquisition process, the data is three-dimensionally identified and archived according to the data source node, data type, and acquisition timestamp.

[0019] S2. Perform data preprocessing on multi-source business data samples to obtain a standardized dataset; The collected multi-source heterogeneous raw data undergoes preprocessing to eliminate noise and anomalies, and to standardize the format and scale differences between data from different sources. This provides a clean and standardized data foundation for subsequent multi-dimensional feature extraction based on power business logic. The preprocessing includes the following steps: 1. Perform data cleaning on multi-source business data samples, including using statistical criteria to identify and correct outliers, fill in missing data, and remove duplicate data; 2. Standardize the cleaned data, including normalizing numerical data, vectorizing text data, and parsing key fields of protocol data and normalizing them to obtain a standardized dataset.

[0020] First, outliers in the data are identified and corrected using the Raida criterion, also known as the Three Sigma criterion, for outlier determination. For any data point... When satisfied The data point was then identified as an outlier. This represents the mean of the current data column. The standard deviation is used; for data points identified as outliers, a linear interpolation method between adjacent points is used for correction, calculated using the following formula: in The corrected value. and These are the preceding and following normal data points, respectively, for the outlier. Next, missing values ​​in the data are imputed; for continuous numerical data, the mean is used for imputation. ,in This is the mean of all non-empty data in the current data column; for discrete categorical data, the mode is used for filling. ,in The most frequent value in the current data column is used; for business-critical time-series data, adjacent time-series linear interpolation is used for filling, and the calculation formula is as follows: ,in For the time points corresponding to the missing values, and These represent the times corresponding to the two most recent valid data points before and after the missing value. and These are the corresponding values. Finally, duplicate data is removed, and the hash fingerprint of each data item is calculated using a hash algorithm. The calculation formula is as follows: Data with the same hash fingerprint is identified as duplicate data and deleted.

[0021] The data standardization process is as follows: For numerical data, the following steps are taken: The data is processed using a fractional standardization method to ensure that the standardized data follows a standard normal distribution with a mean of 0 and a standard deviation of 1. The calculation formula is as follows: ,in These are the original values. This represents the mean of the current data column. The standard deviation is used. For text-based data, a word embedding model is used for vector representation, through... The model converts text data into fixed-dimensional feature vectors, setting the vector dimension to 256. The calculation formula is as follows: For industrial control protocol data, the key fields of the protocol message are first parsed to extract the payload, including device address, function code, register address, and data value fields. Then, the extracted numerical fields are mapped to the [0,1] interval using the min-max normalization method. The calculation formula is as follows: ,in This is the original protocol field value. and These represent the minimum and maximum values ​​of the field, respectively. After the above data cleaning and standardization processes, the final output is a standardized dataset. ,in This represents the total number of data samples.

[0022] S3. Construct a feature extraction rule base based on power business logic. The feature extraction rule base includes static structural feature extraction rules, dynamic behavioral feature extraction rules, and business semantic feature extraction rules. The purpose of constructing a feature extraction rule base is to quantify the domain knowledge and business logic of the power system into computable feature extraction rules, enabling the features extracted from the raw data to fully reflect the inherent laws governing the operating status, operational behavior, and business semantics of power equipment. Power business logic refers to the physical laws, electrical connection relationships, operational procedures, and safety constraints followed by the power system in planning and design, operation control, maintenance, and other stages. Based on this business logic and combined with the experience of power system experts, a feature extraction rule base encompassing three dimensions—static structure, dynamic behavior, and business semantics—is pre-constructed to provide a basis for subsequent automated feature extraction.

[0023] In this embodiment, the static structural feature extraction rules include: calculating device correlation based on the adjacency matrix between devices; calculating permission level features based on the permission level model; and calculating node importance based on the call frequency of business process nodes.

[0024] Specifically, device associativity measures the degree of electrical connection between different devices in a power system. First, a device adjacency matrix is ​​constructed. ,in The total number of devices; if the devices With equipment If there is a direct electrical connection or communication association, then ,otherwise Based on this adjacency matrix, the cosine similarity is used to calculate the correlation between any two devices. The calculation formula is as follows: in The value range is [0,1], and the larger the value, the more important the device is. With equipment The higher the degree of correlation in the topology, the better. The permission hierarchy feature is used to quantify the permission level of operators or system users in the power business system. The permission hierarchy feature is calculated using a hierarchical quantification model, and the calculation formula is: in This represents the total number of permission levels. For the first The weighting coefficient of the hierarchy, This is a Boolean variable, with a value of 1 indicating that the user has the necessary permissions at that level, and a value of 0 indicating that they do not. Node importance is used to assess the criticality of each node in the power business process. Based on historical business process execution records, the number of times each node is invoked is counted, and the node importance calculation formula is: in The value range is [0,1]. The larger the value, the higher the importance of the node in the business process.

[0025] In this embodiment, the dynamic behavior feature extraction rules include: extracting statistical features based on time-series data, including event frequency, mean, variance, and latency fluctuations; extracting state transition probability features based on state transition sequences using a Markov chain model; and extracting interaction strength and interaction success rate based on protocol interaction data.

[0026] Specifically, time-series statistical features are used to characterize the changing patterns of equipment operating status or operational behavior over time. Setting a time window... The formula for calculating event frequency is: The formula for calculating the mean is: ,in For a moment The observed values; the formula for calculating variance. The formula for calculating time delay fluctuation is: ,in This represents the response delay sequence for each interaction within a time window. State transition probability features are used to describe the transition patterns of system operating states or user actions. The power system operating state or user action is discretized into a finite number of states, constructing a state sequence. The state transition probability is calculated using a Markov chain model, and the formula is as follows: in From state Transition to state Number of times, For state The total number of occurrences is used to obtain the state transition probability matrix as a feature. Interaction strength and interaction success rate are used to characterize the activity and reliability of the industrial control protocol's interaction behavior. The formula for calculating protocol interaction strength is as follows: The formula for calculating the success rate of interaction is: .

[0027] In this embodiment, the business semantic feature extraction rules include: combining a power industry dictionary, using the word frequency-inverse document frequency algorithm to calculate the semantic weights of keywords in the text data, and constructing a semantic feature vector.

[0028] Specifically, the first step is to construct a power industry dictionary that includes power system terminology. The dictionary covers specialized terms in areas such as device names, operating instructions, alarm types, and fault symptoms. For each piece of text data... The term frequency-inverse document frequency algorithm is used to calculate the frequency of each keyword. The semantic weight is calculated using the following formula: in Keywords In the text The number of times it appears in For text Total word count This represents the total number of text data entries. For keywords The number of text entries. For each text entry, the TF-IDF weights of all keywords appearing in the power industry dictionary are extracted to form the semantic feature vector of that text. ,in This represents the total number of keywords in the electrical engineering dictionary.

[0029] S4. Based on the feature extraction rule base, extract multi-dimensional features from the standardized dataset to form an initial feature set; Based on the completed feature extraction rule base construction, a standardized dataset is used as input. According to the various feature extraction rules defined in the rule base, multi-dimensional features reflecting the power system equipment status, operational behavior, and business semantics are automatically calculated and generated from the data. This provides a basic feature set for subsequent feature selection and fusion. Please refer to [link to relevant documentation]. Figure 2 Specifically, this is achieved through the following steps: S41. Based on the static structural feature extraction rules, calculate the device correlation degree based on the device adjacency matrix, quantify the permission features based on the permission hierarchy model, calculate the node importance based on the call frequency of business process nodes, and generate static structural features. S42. Based on the dynamic behavior feature extraction rules, extract event frequency, mean, variance and delay fluctuation features from time series data, extract state transition probability features based on state transition sequence through Markov chain model, extract interaction strength and interaction success rate features from protocol interaction data, and generate dynamic behavior features. S43. Based on the business semantic feature extraction rules, and combined with the power industry dictionary, calculate the semantic weight of keywords in the text data using the word frequency-inverse document frequency algorithm to generate business semantic features; S44. Combine static structural features, dynamic behavioral features, and business semantic features to form an initial feature set.

[0030] Specifically, when generating static structural features, device ledger data, network topology configuration data, and permission allocation data are obtained from a standardized dataset. Each feature value is calculated sequentially according to the static structural feature extraction rules: for device correlation, after constructing a device adjacency matrix based on the connection relationships between devices, the correlation value is calculated for each pair of devices; for permission hierarchy features, the permission configuration records of each user or system account are traversed, and the corresponding permission value is calculated according to the permission hierarchy quantification model; for node importance, the frequency of occurrence of each node in historical business process logs is statistically analyzed, and the frequency of each node being called is calculated as its importance index. The calculated feature values ​​are then organized according to a preset data structure to form a static structural feature vector.

[0031] When generating dynamic behavior features, device runtime sequence data, operation record sequence data, and protocol communication data are obtained from a standardized dataset. For each time-series data stream, a fixed-length time window is set and slides along the time axis. Within each window, the ratio of the number of events occurring to the window duration is calculated as the frequency; the arithmetic mean of all observations within the window is calculated as the mean; the average of the squares of the deviations of the observations from the mean is calculated as the variance; and the difference between the maximum and minimum response delays within the window is calculated as the delay fluctuation. For the operation record sequence, continuous operation records are discretized into a state sequence. The number of transitions from each state to other states is counted, and the ratio of the number of transitions to the total number of occurrences is calculated as the state transition probability. For the protocol communication data, the total amount of data transmitted within a unit time window is counted and divided by the window duration to obtain the interaction intensity; the ratio of the number of successful interactions to the total number of interactions is calculated as the interaction success rate. After aligning the extracted dynamic feature values ​​according to time sequence, a dynamic behavior feature vector is formed.

[0032] When generating business semantic features, text data such as scheduling logs, operation records, and alarm information are obtained from a standardized dataset. Each text data is segmented, and keywords appearing in the power industry dictionary are extracted. The frequency of each keyword is calculated by counting the number of times it appears in the current text and the total number of words in the text. The inverse document frequency (IVF) is calculated by counting the number of texts containing the keyword and the total number of texts. The semantic weight of each keyword is obtained by multiplying the word frequency and the IVF. All weight values ​​are arranged in a fixed order according to the keywords in the power industry dictionary to form the semantic feature vector of the text data.

[0033] Finally, when forming the initial feature set, for each data sample, its corresponding static structural feature vector, dynamic behavioral feature vector, and business semantic feature vector are horizontally concatenated in a preset order to form the initial feature vector of that sample. The initial feature vectors of all samples together constitute the initial feature set. ,in The total dimension of the initial features.

[0034] S5. Perform feature filtering on the initial feature set, removing redundant and invalid features to obtain a core feature subset; The purpose of filtering the initial feature set is to remove redundant information and noise interference, reduce the feature dimensionality, and retain the core features that are strongly related to the power business objectives, thereby improving the efficiency and accuracy of subsequent modeling. This is achieved through the following steps: 1. Perform redundancy analysis on the features in the initial feature set. For numerical features, calculate the correlation between features. For discrete features, calculate the mutual information between features. Features with mutual information exceeding a preset threshold are identified as redundant features. Among the redundant feature pairs, retain the features with high relevance to the power business and remove the rest of the redundant features. 2. Verify the effectiveness of the feature set after removing redundant features. Calculate the contribution of each feature to the power business objectives using a machine learning model as the feature importance. Features with an importance lower than a preset threshold are identified as invalid features and removed to obtain the core feature subset.

[0035] Specifically, in the redundancy analysis phase, the initial feature set is first traversed. All feature pairs are included. For numerical features, the Pearson correlation coefficient is used to measure the degree of linear correlation between two features. For any two numerical features... and Given The correlation coefficient for each sample of observations is calculated using the following formula: in and Features and The mean, For the first Each sample in features The value at the specified value. Setting the correlation threshold. ,when When determining features and There is a high degree of redundancy between them. For discrete features, mutual information is used to measure the dependence between two features, and the calculation formula is: in and Features and The set of possible values, This is the joint probability distribution of the two feature values. and These are the marginal probability distributions. A mutual information threshold is set. ,when When a pair of features is deemed highly redundant, one must be selected to be retained. The retention criterion is the feature's relevance to the power business. This relevance can be comprehensively assessed based on factors such as whether the feature belongs to the business semantic features defined in S3, whether it is marked as a high-risk related feature in expert rules, or whether it has been verified as an important feature in historical business scenarios. Within each redundant feature pair, the feature with higher business relevance is retained, while the other feature is removed.

[0036] In the validity verification phase, the random forest algorithm is used to calculate feature importance. The feature set after removing redundant features is used as input, and the labels of power business objectives (such as anomaly detection, fault diagnosis, risk quantification, etc.) are used as supervision signals to train the random forest model. The random forest is composed of... The decision tree is composed of several trees, for each feature. The importance of a feature is measured by calculating the change in the model's error on out-of-bag data before and after its removal. The calculation formula is as follows: in For the first The error of each decision tree on the original out-of-bag data, To feature The value of is randomly shuffled. The error of each decision tree on out-of-bag data. Setting an importance threshold. ,when If the feature is deemed to contribute little to the target task, it is considered an invalid feature and is therefore removed.

[0037] After the two rounds of screening, including redundancy analysis and effectiveness verification, the retained features constitute the core feature subset. ,in The total dimension of the core features, and This core feature subset contains neither highly redundant feature pairs nor invalid features that contribute little to the target task, thus exhibiting high feature quality and business relevance.

[0038] S6. An attention mechanism is used to fuse features in the core feature subset, and the fused features are semantically encapsulated to output the target feature set, thus completing the construction of the feature extraction model.

[0039] The purpose of fusing the core feature subset obtained after screening is to rationally integrate the contributions of features from different dimensions and types, while eliminating the differences in scale and semantics between heterogeneous features. This results in a more expressive and robust unified feature representation, and semantic encapsulation enhances the interpretability of the features. The final output is a high-quality target feature set that can be directly used for power business modeling. Please refer to [link / reference]. Figure 3 Specifically, this is achieved through the following steps: S61. Calculate the attention score for each feature in the core feature subset. The attention score is determined based on the feature itself and its corresponding business semantic vector. S62. Calculate the attention weight for each feature based on the attention score using a normalized exponential function; S63. Based on the attention weights, perform a weighted summation of the features in the core feature subset to generate a fused feature vector; S64. To address the dimensional differences between heterogeneous features, a feature cross-network is used to unify the dimensions of the fused feature vector.

[0040] Specifically, the core idea of ​​the attention mechanism is to dynamically assign weights based on the importance of each feature in the current business context. First, for the core feature subset... Each feature in It is necessary to obtain its corresponding business semantic vector. The semantic vector can be extracted from the business semantic features generated in S43. If a feature itself is not a textual semantic feature, its corresponding semantic representation can be obtained by mapping the feature name to a predefined feature semantic embedding table. The feature value and its semantic vector are concatenated to form a joint representation. Then, an attention score for each feature is calculated using a learnable attention scoring network: in This is the weight matrix. As a bias term, the scoring network maps the concatenated vector to a scalar score. To ensure comparability of scores across all features, a normalized exponential function is used to normalize the scores, yielding the attention weight for each feature: Attention weight satisfy ,and The larger the value, the more characteristic it represents. The higher the importance in the current fusion, the better. Subsequently, based on the attention weights, all features in the core feature subset are weighted and summed to obtain a preliminary fused feature vector: Since the features in the core feature subset may come from different types and have different original dimensions, direct weighted summation may lead to dimensionality mismatch. Therefore, a feature cross-processing network is introduced to unify the dimensions of the fused feature vector. The feature cross-processing network combines Hadamard product and linear transformation to cross the initially fused features with their corresponding semantic vectors and map them to a unified dimensional space. in It represents the Hadamah accumulation. This is a learnable transformation matrix. In practice, the above cross operation is usually performed on all features, followed by averaging or reweighting, ultimately resulting in a unified dimension matrix. fused feature vector .

[0041] After feature fusion is completed, the fused feature vectors are semantically encapsulated. Semantic encapsulation refers to adding standardized business semantic descriptions to each feature dimension after fusion, making it interpretable. Specifically, this involves establishing a feature dimension and a power business rule set. Define the association mapping between them and define the business association function: This function measures the degree of matching between the fused feature vector and the power business rules. Furthermore, the risk correlation of each fused feature can be calculated: in For adjustment coefficients, The value ranges from [0,1], with larger values ​​indicating a stronger correlation between the feature and business risk. Finally, each dimension in the fused feature vector is labeled with its corresponding feature meaning, business scenario, and risk correlation, forming a high-quality target feature set that can be directly used for modeling tasks such as power system cybersecurity situational awareness, attack chain deduction, and resilience assessment.

[0042] Example 2 An embodiment of the device for constructing a feature extraction model for multi-source business data of a power system according to the present invention includes the following: The multi-source business data sample acquisition module is used to acquire multi-source business data samples of the power system. The multi-source business data samples include text data, numerical data and protocol data. The standardized dataset determination module is used to preprocess multi-source business data samples to obtain a standardized dataset; The feature extraction rule base construction module is used to build a feature extraction rule base based on power business logic. The feature extraction rule base includes static structural feature extraction rules, dynamic behavioral feature extraction rules, and business semantic feature extraction rules. The initial feature set determination module is used to extract multi-dimensional features from the standardized dataset according to the feature extraction rule base to form an initial feature set; The core feature subset determination module is used to filter features from the initial feature set, remove redundant and invalid features, and obtain the core feature subset. The target feature set output module is used to fuse features in the core feature subset using an attention mechanism, and to semantically encapsulate the fused features to output the target feature set, thus completing the construction of the feature extraction model.

[0043] For specific limitations regarding the device, please refer to the limitations of the method above, which will not be repeated here. Each module in the above device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0044] Example 3 The present invention provides an electronic device, including a memory for storing a computer program and a processor for executing the computer program to implement the steps of the method described above.

[0045] It is understood that those skilled in the art can combine various implementation methods in the above embodiments under the guidance of the above examples to obtain technical solutions with multiple implementation methods.

[0046] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for constructing a feature extraction model of multi-source business data of a power system, characterized in that, include: Acquire multi-source business data samples from the power system, wherein the multi-source business data samples include text data, numerical data, and protocol data; The multi-source business data samples are preprocessed to obtain a standardized dataset; A feature extraction rule base is constructed based on power business logic. The feature extraction rule base includes static structural feature extraction rules, dynamic behavioral feature extraction rules, and business semantic feature extraction rules. Based on the feature extraction rule base, multi-dimensional features are extracted from the standardized dataset to form an initial feature set; The initial feature set is subjected to feature filtering to remove redundant and invalid features, resulting in a core feature subset; An attention mechanism is used to fuse the features in the core feature subset, and the fused features are semantically encapsulated to output the target feature set, thus completing the construction of the feature extraction model. 2.The method of claim 1, wherein, The step of preprocessing the multi-source business data samples to obtain a standardized dataset includes: Data cleaning is performed on the multi-source business data samples, including identifying and correcting outliers using statistical criteria, filling in missing data, and removing duplicate data. The cleaned data is standardized, including normalizing numerical data, vectorizing text data, and parsing key fields of protocol data and normalizing them to obtain a standardized dataset. 3.The method of claim 1, wherein, The static structural feature extraction rules include: calculating device correlation based on the adjacency matrix between devices; calculating permission level features based on the permission level model; and calculating node importance based on the call frequency of business process nodes. 4.The method of claim 1, wherein, The dynamic behavior feature extraction rules include: extracting statistical features based on time-series data, including event frequency, mean, variance, and latency fluctuations; extracting state transition probability features based on state transition sequences using a Markov chain model; and extracting interaction strength and interaction success rate based on protocol interaction data.

5. The method for constructing a feature extraction model for multi-source business data of a power system according to claim 1, characterized in that, The business semantic feature extraction rules include: combining a power industry dictionary, using the word frequency-inverse document frequency algorithm to calculate the semantic weights of keywords in the text data, and constructing a semantic feature vector.

6. The method for constructing a feature extraction model for multi-source business data of a power system according to claim 1, characterized in that, The step of extracting multi-dimensional features from the standardized dataset according to the feature extraction rule base to form an initial feature set includes: Based on the static structural feature extraction rules, the device correlation degree is calculated based on the device adjacency matrix, the permission features are quantified based on the permission hierarchy model, and the node importance is calculated based on the call frequency of business process nodes to generate static structural features. According to the dynamic behavior feature extraction rules, event frequency, mean, variance and delay fluctuation features are extracted from time series data, state transition probability features are extracted based on state transition sequences using a Markov chain model, and interaction strength and interaction success rate features are extracted from protocol interaction data to generate dynamic behavior features. Based on the business semantic feature extraction rules, and combined with the power industry dictionary, the semantic weights of keywords in the text data are calculated using the word frequency-inverse document frequency algorithm to generate business semantic features; The static structural features, dynamic behavioral features, and business semantic features are combined to form an initial feature set.

7. The method for constructing a feature extraction model for multi-source business data of a power system according to claim 1, characterized in that, The initial feature set is subjected to feature filtering to remove redundant and invalid features, resulting in a core feature subset, including: Redundancy analysis is performed on the features in the initial feature set. For numerical features, the correlation between features is calculated, and for discrete features, the mutual information between features is calculated. Features with mutual information exceeding a preset threshold are identified as redundant features. Among the redundant feature pairs, features with a high degree of relevance to power business are retained, and the remaining redundant features are eliminated. The validity of the feature set after removing redundant features is verified. The contribution of each feature to the power business objective is calculated by a machine learning model as the feature importance. Features with a feature importance lower than a preset threshold are judged as invalid features and removed, thus obtaining the core feature subset.

8. The method for constructing a feature extraction model for multi-source business data of a power system according to claim 1, characterized in that, The process of fusing features in the core feature subset using an attention mechanism includes: Calculate the attention score for each feature in the core feature subset, whereby the attention score is determined based on the feature itself and its corresponding business semantic vector; The attention weight for each feature is calculated using a normalized exponential function based on the attention score. Based on the attention weights, the features in the core feature subset are weighted and summed to generate a fused feature vector; To address the dimensional differences between heterogeneous features, a feature cross-network is used to unify the dimensions of the fused feature vector.

9. A device for constructing a feature extraction model for multi-source business data of a power system, characterized in that, The method for constructing a feature extraction model for multi-source business data of a power system according to any one of claims 1 to 8 includes: A multi-source business data sample acquisition module is used to acquire multi-source business data samples of the power system, wherein the multi-source business data samples include text data, numerical data and protocol data; The standardized dataset determination module is used to preprocess the multi-source business data samples to obtain a standardized dataset. The feature extraction rule base construction module is used to construct a feature extraction rule base based on power business logic. The feature extraction rule base includes static structural feature extraction rules, dynamic behavioral feature extraction rules, and business semantic feature extraction rules. The initial feature set determination module is used to extract multi-dimensional features from the standardized dataset according to the feature extraction rule base to form an initial feature set; The core feature subset determination module is used to perform feature filtering on the initial feature set, remove redundant and invalid features, and obtain the core feature subset; The target feature set output module is used to fuse the features in the core feature subset using an attention mechanism, and to semantically encapsulate the fused features to output the target feature set, thus completing the construction of the feature extraction model.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor is configured to execute the computer program to implement the method for constructing a feature extraction model for multi-source business data of a power system as described in any one of claims 1 to 8.

Images