Automated Abnormal Behavior Recognition System for Power Control Systems Based on Deep Learning

Abstract

This invention relates to the field of power control system safety detection technology, specifically disclosing an automated identification system for abnormal behavior in power control systems based on deep learning. The system collects normal telemetry data from various nodes of the power control system under multiple operating conditions. A common embedding function is obtained through training with a three-layer graph convolutional layer of a deep equilateral neural network, superimposed with node permutation invariant regularization terms and contrastive loss. This maps telemetry data of the same physical state under different topologies to topology-invariant manifold coordinates. Kernel density estimation is used to construct the region occupied by normal behavior. Real-time telemetry data is collected online, mapped to real-time manifold coordinates through the common embedding function, and the drift distance from the normal region is calculated. The drift distance is compared with a dynamic threshold; if it exceeds the threshold, it is judged as abnormal and an alarm is triggered. This invention does not rely on a fixed topology structure, can adapt to dynamic topology changes, avoids lag caused by retraining, and improves the accuracy and real-time performance of anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of power control system security detection technology, specifically to an automated identification system for abnormal behavior in power control systems based on deep learning. Background Technology

[0002] The safe and stable operation of power industrial control systems depends on the rapid and accurate identification of abnormal behaviors. Common abnormal behaviors include network attacks, equipment failures, and human error. Traditional anomaly detection methods are mostly based on fixed threshold rules or shallow models based on statistical features, which are difficult to handle high-dimensional, nonlinear industrial control data with strong temporal correlations. In recent years, deep learning technology has been introduced into this field. By automatically learning temporal patterns from normal historical data, it has achieved anomaly detection without relying on attack signatures, achieving good results. However, the black-box nature of deep learning models leads to a lack of interpretability in their decision-making process. The introduction of interpretable artificial intelligence can help reveal the basis for anomaly judgment, increase the trust of operation and maintenance personnel in the detection results, and assist in the root cause location of faults.

[0003] In power control systems where the topology changes frequently due to switching operations, fault isolation, or network reconfiguration, existing deep learning methods, relying on fixed adjacency matrices, cannot simultaneously consider the utilization of spatial correlation features and topology adaptability. This results in either false alarms or missed alarms due to topology failures, or response lags due to the need for retraining. This invention maps telemetry data with the same physical state under different topologies to topology-invariant manifold coordinates by constructing a common embedding function. Anomaly detection is then performed using the drift distance of these manifold coordinates. Without relying on explicit topology structures or requiring retraining, this invention effectively utilizes the spatial constraints of electrical quantities between nodes to achieve accurate identification of abnormal behavior in dynamic topology environments. Summary of the Invention

[0004] The purpose of this invention is to provide an automated identification system for abnormal behavior of power industrial control systems based on deep learning, so as to solve the problems mentioned above.

[0005] The objective of this invention can be achieved through the following technical solutions: An automated identification system for abnormal behavior in power industrial control systems based on deep learning includes: The data acquisition module is used to collect normal telemetry data of each node of the power control system under various operating conditions. The normal telemetry data includes: three-phase voltage, active power, reactive power and frequency. The manifold alignment training module performs manifold alignment training on normal telemetry data to obtain a common embedding function. The common embedding function maps telemetry data with the same physical state under different topologies to neighboring coordinates in the embedding space, and outputs topology-invariant manifold coordinates. The normal region construction module maps normal telemetry data into a historical topological invariant manifold coordinate set through a common embedding function, and uses kernel density estimation to construct the region occupied by the normal behavior of the corresponding coordinate set in the embedding space. The real-time mapping and drift calculation module collects real-time telemetry data online, calculates the real-time manifold coordinates through a common embedding function, and measures the drift distance of the real-time manifold coordinates from the area occupied by normal behavior. The anomaly detection module compares the drift distance with a dynamic threshold. When the drift distance exceeds the dynamic threshold, it is determined to be an abnormal behavior and an alarm signal is output.

[0006] As a further aspect of the present invention: the construction process of the public embedded function is as follows: The three-phase voltage and power values ​​in normal telemetry data are used as input features and input into the first graph convolutional layer of a deep equilateral neural network. After extracting local neighborhood correlations, the first intermediate feature is output. The first intermediate feature is input into the second graph convolutional layer, and a learnable node permutation invariant regularization term is superimposed to output the second intermediate feature. The second intermediate feature is mapped to low-dimensional manifold coordinates through a third graph convolutional layer, and contrastive loss is used to constrain the proximity of coordinates of the same physical state under different topologies to obtain a common embedding function.

[0007] As a further aspect of the present invention: the output process of the topologically invariant manifold coordinates is as follows: Normal telemetry data are grouped by time window, the voltage phase angle difference sequence between nodes in each group is calculated, and the second to fourth order statistical moments of the voltage phase angle difference sequence are extracted as local invariant descriptors. Perform local linear alignment on the descriptors of adjacent windows to construct an initial estimate of the global low-dimensional coordinates; By minimizing the reconstruction error of all window descriptors in the low-dimensional space, the coordinates are iteratively updated until convergence, and the output is the coordinates of the topologically invariant manifold.

[0008] As a further aspect of the present invention: the initial estimate for constructing global low-dimensional coordinates specifically includes: The descriptor of the first time window is selected as the global reference anchor point, and its low-dimensional coordinates are set as the zero vector; For each subsequent adjacent window, solve for the local linear transformation coefficients between the adjacent window descriptor and the previous window descriptor, so as to minimize the Euclidean distance between the transformed descriptor and the previous window descriptor. The coefficients of the current window descriptor are mapped to the low-dimensional coordinate space of the previous window through a local linear transformation, and the initial estimate of the global low-dimensional coordinates of all windows is obtained by recursion.

[0009] As a further aspect of the present invention: the process for identifying the area occupied by normal behavior is as follows: Each coordinate point in the historical topological invariant manifold coordinate set is taken as a sample point. The Euclidean distance between each sample point and its k-th nearest neighbor sample point is calculated, and the median of all distances is taken as the initial bandwidth. A Gaussian kernel function is constructed with each sample point as the center and the initial bandwidth as the radius. The probability density distribution in the embedding space is obtained by summing all kernel functions. The 95% region with the highest probability density value is selected as the region occupied by normal behavior, and the remaining regions are marked as potential abnormal regions.

[0010] As a further aspect of the present invention: the output process of the probability density distribution is as follows: For each sample point, calculate the average distance between the sample point and its three nearest neighbors, and use the ratio of the average distance to the initial bandwidth as the kernel function scaling factor; An isotropic Gaussian kernel function is constructed with the sample point as the center and the product of the scaling factor and the initial bandwidth as the radius. The embedding space is discretized into a uniform grid, and the values ​​of all Gaussian kernel functions are accumulated at each grid node. After normalization, the probability density distribution is output.

[0011] As a further aspect of the present invention: the process of measuring the drift distance is as follows: Determine the location of the real-time manifold coordinates in the embedding space, and search for the nearest boundary point to the boundary of the region occupied by the normal behavior. Calculate the direction of the line connecting the location point and the nearest boundary point, and extend the line direction into the region by one unit step to obtain the reference point. The Euclidean distance between the location point and the reference point is used as the drift distance. If the location point is located within the region, the drift distance is taken as a negative value.

[0012] As a further aspect of the present invention: the search process for the nearest boundary point is as follows: Construct a hypersphere with the location point as the center and the initial radius set to half the minimum distance between all sample points in the embedding space; Gradually increase the radius of the hypersphere, and after each increase, check whether the hypersphere contains the boundary point of the area occupied by normal behavior, until the first boundary point is detected. The point closest to the location point among all detected boundary points is determined as the nearest boundary point.

[0013] The beneficial effects of this invention are: (1) Because a common embedding function is obtained through manifold alignment training, this function maps telemetry data of the same physical state under different topologies to neighboring coordinates in the embedding space. This ensures that the manifold coordinates corresponding to topology switching behaviors such as normal switching operations, fault isolation, or network reconfiguration still fall within the area occupied by the normal behavior and will not trigger alarms due to topology changes. Compared with methods that rely on fixed adjacency matrices, this invention does not require retraining or online updating of the model with topology changes, avoiding misjudgments caused by topology abrupt changes, and reducing the confirmation burden on on-site maintenance personnel.

[0014] (2) This invention only requires the collection of time-series telemetry data (three-phase voltage, active power, reactive power, and frequency) of each node, without the need to acquire or maintain topology information such as node connection relationships and line parameters of the power system. The training of the common embedding function is entirely data-driven, and the output manifold coordinates are independent of the specific graph structure. Therefore, when deployed in actual substations or dispatch centers, there is no need to configure additional topology analysis modules or manually enter wiring diagrams, reducing the workload in the early stages of engineering implementation and the dependence on professional knowledge. It is suitable for active distribution networks and microgrid scenarios with frequent topology changes. Attached Figure Description

[0015] The invention will now be further described with reference to the accompanying drawings.

[0016] Figure 1 This is a system block diagram of the present invention; Figure 2 This is a flowchart illustrating the construction process of the common embedded function in this invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figure 1 As shown, this invention is an automated identification system for abnormal behavior in power industrial control systems based on deep learning, comprising: The data acquisition module is used to collect normal telemetry data of each node of the power control system under various operating conditions. The normal telemetry data includes: three-phase voltage, active power, reactive power and frequency. The manifold alignment training module performs manifold alignment training on normal telemetry data to obtain a common embedding function. The common embedding function maps telemetry data with the same physical state under different topologies to neighboring coordinates in the embedding space, and outputs topology-invariant manifold coordinates. The normal region construction module maps normal telemetry data into a historical topological invariant manifold coordinate set through a common embedding function, and uses kernel density estimation to construct the region occupied by the normal behavior of the corresponding coordinate set in the embedding space. The real-time mapping and drift calculation module collects real-time telemetry data online, calculates the real-time manifold coordinates through a common embedding function, and measures the drift distance of the real-time manifold coordinates from the area occupied by normal behavior. The anomaly detection module compares the drift distance with a dynamic threshold. When the drift distance exceeds the dynamic threshold, it is determined to be an abnormal behavior and an alarm signal is output.

[0019] The data acquisition module is used to collect normal telemetry data from various nodes of the power control system under multiple operating conditions. This normal telemetry data includes: three-phase voltage, active power, reactive power, and frequency, specifically including: Normal telemetry data is collected from various nodes of the power control system under multiple operating conditions. These nodes include busbars, transmission lines, transformer windings, and generator outlets within the substation. Intelligent electronic devices (IEDs) and merging units (MUs) deployed at each node synchronously collect instantaneous values ​​of three-phase voltage and three-phase current at a sampling frequency of 50 times per second. The effective values ​​of the three-phase voltage, active power, reactive power, and frequency are then calculated by the connected digital measurement and control device. Simultaneously, telemetry data from the remote terminal units (RTUs) of the Supervisory Control and Data Acquisition (SCADA) system at the same time point are read to verify the accuracy of the collected values. To cover multiple operating conditions, data is collected during the following scenarios: planned switching operations (such as the opening and closing of busbar sectionalizing switches, line power outages and restorations), periods of slow load ramp-up (morning peak, evening valley), periods of fluctuating renewable energy output, and when the system is adjusting reactive power and voltage. Each continuous data collection session lasted at least 24 hours, and all data underwent manual verification and coarse screening based on historical thresholds to remove obviously bad data caused by temporary sensor failures or communication errors. The final result was a pure normal telemetry dataset reflecting only the system's normal electrical behavior. The collected data was grouped by time windows, with each window containing 10 consecutive sampling points (corresponding to 0.2 seconds). The three-phase voltage, active power, reactive power, and frequency values ​​within each window were stored as floating-point numbers as input for subsequent steps. Normal telemetry data refers to telemetry data without anomalies.

[0020] Please see Figure 2 As shown, in the manifold alignment training module, manifold alignment training is performed on normal telemetry data to obtain a common embedding function. This common embedding function maps telemetry data with the same physical state under different topologies to neighboring coordinates in the embedding space, outputting topology-invariant manifold coordinates, specifically including: The effective values ​​of three-phase voltage, active power, reactive power, and frequency from normal telemetry data are used as input features and fed into the first graph convolutional layer of a deep equilateral neural network. This convolutional layer uses a normalized adjacency matrix to perform a weighted summation of the features of each node and the features of its neighbors, where the weights are the reciprocals of the node's degree. After extracting local neighborhood correlations, it outputs the first intermediate feature. This first intermediate feature is then fed into the second graph convolutional layer, with a learnable node permutation invariant regularization term superimposed. This regularization term is implemented by calculating the difference between the element-wise maximum and average of the feature vectors of all nodes output by the second graph convolutional layer, multiplying this difference by a trainable scalar coefficient, and adding it to the original output to obtain the second intermediate feature. This regularization term makes the network insensitive to node number rearrangement, thus ignoring the specific order of topological connections. Finally, the second intermediate feature is mapped to low-dimensional manifold coordinates via a third graph convolutional layer, with the dimension set to 3. During training, a contrastive loss is used to constrain the proximity of coordinates for the same physical state under different topologies. The contrastive loss is calculated as follows: For each anchor sample, a positive sample is randomly selected from samples with the same physical state but different topologies, and a negative sample is randomly selected from samples with different physical states. The loss value is the Euclidean distance between the anchor and the positive sample minus the Euclidean distance between the anchor and the negative sample, plus a fixed boundary value of 1. If the result is less than 0, it is set to 0. The network parameters are optimized through backpropagation to finally obtain the common embedding function.

[0021] The output process of topologically invariant manifold coordinates is as follows: Normal telemetry data are grouped into time windows, each containing 10 consecutive sampling points (corresponding to 0.2 seconds). The voltage phase angle difference sequence between nodes within each group is calculated. The voltage phase angle is obtained from the instantaneous values ​​of the three-phase voltage using the zero-crossing detection method, and the phase angle difference is the difference between the voltage phase angles of node i and node j. For all phase angle difference values ​​within each window (a total of N(N-1) / 2 pairs, where N is the number of nodes), their second-order statistical moments (variance), third-order statistical moments (skewness), and fourth-order statistical moments (kurtosis) are extracted as local invariant descriptors. The formulas for calculating the second-order moment are: the average of the squares of each difference minus the square of the average; the third-order moment is the average of the cubes of each difference minus 3 times the variance multiplied by the average, then minus the cube of the average; the fourth-order moment is the average of the fourth power of each difference minus 4 times the third-order moment multiplied by the average, then minus 6 times the variance multiplied by the square of the average, then minus the fourth power of the average. The aforementioned descriptors do not depend on the absolute node numbers or specific connection relationships; they only reflect the distribution shape of local electrical quantities. Next, local linear alignment is performed on the descriptors of adjacent windows to construct an initial estimate of the global low-dimensional coordinates. The coordinates are iteratively updated until convergence by minimizing the reconstruction error of all window descriptors in the low-dimensional space. The reconstruction error is defined as the sum of the mean squared errors between the low-dimensional coordinates of each window and the predicted values ​​of its descriptors after a learnable linear projection. Gradient descent is used for 500 iterations, and the output after convergence is a topology-invariant manifold coordinate. The number of nodes remains fixed during normal telemetry data acquisition; if the number of nodes changes during actual operation, descriptors are calculated only for the common node set.

[0022] The initial estimate of the global low-dimensional coordinates is constructed by the following steps: First, the descriptor of the first time window is selected as the global reference anchor point, and its low-dimensional coordinates are set as the zero vector. Second, for each subsequent adjacent window (the first... Window and the For each window descriptor, find the local linear transformation coefficients between it and the previous window descriptor to minimize the Euclidean distance between the transformed descriptor and the previous window descriptor. These transformation coefficients are obtained by solving the following formula using the least squares method: ; in, For the first Window descriptor matrix (size: , The number of node pairs. (The number of moments is counted) This is the descriptor matrix of the previous window. Let be the linear transformation coefficient matrix to be solved (size: When solving, for After regularization (adding 0.01 times the identity matrix) and inversion, we get... ,in This represents the identity matrix. The third step is to set the current window descriptor... Multiply by the transformation coefficient After obtaining the mapped descriptor, this descriptor is then mapped to the low-dimensional coordinate space of the previous window through nearest neighbor projection. Specifically, in the low-dimensional coordinate set of the previous window, the three points with the closest Euclidean distance to the mapped descriptor are found, and the initial estimate of the low-dimensional coordinates of the current window is obtained by weighting the average of the inverse distances. This process is repeated to obtain the initial global low-dimensional coordinate estimates for all windows.

[0023] The initial estimate is optimized by minimizing the reconstruction error. The reconstruction error is defined as: ; in, For the first The current low-dimensional coordinates of the window (dimension 3). For the first The window descriptor matrix, This is a trainable linear projection matrix (3×p). During optimization, it is fixed. Alternate updates and First fix it Updated using least squares method Then fix Update using gradient descent. After 100 iterations, the final topologically invariant manifold coordinates are obtained. This coordinate set serves as the historical topologically invariant manifold coordinate set and is used to subsequently construct the regions occupied by normal behavior.

[0024] In the normal region construction module, normal telemetry data is mapped to a historical topological invariant manifold coordinate set through a common embedding function, and kernel density estimation is used to construct the region occupied by the normal behavior of the corresponding coordinate set in the embedding space, specifically including: Each coordinate point in the historical topologically invariant manifold coordinate set is treated as a sample point. For each sample point, the Euclidean distance between it and its k-th nearest neighbor sample point is calculated, where k is the square root of the total number of sample points, rounded to the nearest integer. After traversing all sample points, a set of distance values ​​is obtained, and the median of this set of distance values ​​is taken as the initial bandwidth. This initial bandwidth is used for scaling control in subsequent kernel density estimation.

[0025] A Gaussian kernel function is constructed with each sample point as the center and the initial bandwidth as the radius. The Gaussian kernel functions corresponding to all sample points are accumulated in the embedding space to obtain the probability density value at any position in the embedding space. Specifically, for any position in the embedding space, the squared Euclidean distance from that position to each sample point is calculated, then divided by twice the squared initial bandwidth, the negative exponent is taken, the sum is obtained, and then divided by the total number of sample points multiplied by the square root of 2 and the squared initial bandwidth. This yields the probability density value at that position. This step obtains the probability density distribution for all positions in the embedding space.

[0026] Based on the probability density distribution described above, the 95% region with the highest probability density values ​​is selected as the region occupied by normal behavior. In practice, the probability density values ​​of all locations are first sorted from largest to smallest. Then, starting from the maximum value, the corresponding volume or number of grid cells is accumulated until the accumulated value reaches 95% of the total volume or total number of grid cells. The set of all locations corresponding to this point is the region occupied by normal behavior. The remaining regions with lower probability density values ​​are marked as potential abnormal regions.

[0027] When constructing the probability density distribution, an adaptive bandwidth adjustment is further performed on each sample point. Specifically, for each sample point, the average distance between that sample point and its three nearest neighbors is calculated. The ratio of this average distance to the initial bandwidth is used as the kernel function scaling factor. If the average distance is greater than the initial bandwidth, the scaling factor is greater than 1, widening the kernel function; conversely, it is less than 1, narrowing the kernel function. This scaling factor reflects the sparseness or density of the local region of the sample point.

[0028] An isotropic Gaussian kernel function is constructed with each sample point as the center and the product of the scaling factor and the initial bandwidth as the actual radius. This kernel function decays at the same rate in all directions. The size of the actual radius determines the range of influence of the sample point on the surrounding area: in densely populated regions, the actual radius is smaller, and the kernel function's influence range is narrower; in sparsely populated regions, the actual radius is larger, and the kernel function's influence range is wider. This constructed Gaussian kernel function can adaptively adapt to local density variations of sample points in the embedding space.

[0029] The embedding space is discretized into a uniform grid. Each dimension of the grid is divided into 50 equally spaced intervals, resulting in a total of 50 grid nodes (the power of the embedding space dimension). At each grid node, the Gaussian kernel function values ​​of all sample points at that node are summed to obtain the original accumulated value for that node. Finally, the original accumulated values ​​of all grid nodes are divided by their sum to complete the normalization process, outputting the normalized probability density distribution. This distribution describes the probability density of the region occupied by normal behavior in the embedding space.

[0030] In the real-time mapping and drift calculation module, real-time telemetry data is acquired online, and real-time manifold coordinates are calculated using a common embedding function. The drift distance of the real-time manifold coordinates from the area occupied by normal behavior is also measured, specifically including: Real-time telemetry data is acquired online, including three-phase voltage RMS values, active power values, reactive power values, and frequency values. The sampling frequency is the same as that of normal telemetry data, i.e., 50 times per second. Ten consecutive sampling points within each time window are input into a pre-trained common embedding function, which calculates and outputs a three-dimensional real-time manifold coordinate. This real-time manifold coordinate is marked as a location point in the embedding space. This location point represents the current operating state in the low-dimensional manifold space.

[0031] After determining the location point corresponding to the real-time manifold coordinates, it is necessary to search for the nearest boundary point from that location point to the boundary of the region occupied by normal behavior. The search process is as follows: Using this location point as the center, the initial radius is set to half the minimum distance between all historical sample points in the embedding space. The minimum distance between all historical sample points is obtained by traversing each pair of sample points in the historical topologically invariant manifold coordinate set and calculating the Euclidean distance, taking the minimum value among them. A hypersphere is then constructed using this initial radius.

[0032] The hypersphere radius is gradually increased, with each increment equal to one-tenth of the initial radius. After each radius increase, it is checked whether the current hypersphere contains boundary points of regions occupied by normal behavior. Boundary points of regions occupied by normal behavior are defined as points on the outer surface of that region in the embedding space, specifically identified by determining whether a point's neighborhood simultaneously contains mesh nodes belonging to both regions occupied by normal behavior and potential anomalous regions. This process is repeated until at least one boundary point is detected falling into the hypersphere for the first time.

[0033] When a boundary point is detected for the first time, the positions of all boundary points within the current hypersphere are recorded. Among these boundary points, the Euclidean distance between each boundary point and the location point is calculated, and the point with the smallest distance is selected as the nearest neighbor boundary point. This nearest neighbor boundary point is the contact point on the shortest path from the location point in the embedded space to the boundary of the region occupied by normal behavior.

[0034] After obtaining the nearest boundary point, the direction of the line connecting the current location point and the nearest boundary point is calculated. Specifically, the coordinates of the current location point are subtracted from the coordinates of the nearest boundary point to obtain the direction vector. Then, this direction vector is extended from the nearest boundary point into the region occupied by normal behavior by one unit step to obtain the reference point. The size of this unit step is equal to 1% of the average distance between all sample points in the embedding space, where the average distance is the average of the Euclidean distances between all historical sample point pairs.

[0035] The Euclidean distance between the location point and the reference point is calculated and used as the drift distance. If the location point is inside the area occupied by normal behavior, the drift distance is negative; if the location point is outside the area, the drift distance is positive. Whether the location point is inside the area is determined by whether the probability density at that point is greater than the probability density at the boundary of the area occupied by normal behavior. The value of this drift distance directly reflects the degree to which the real-time operating state deviates from the normal behavior pattern and is used for subsequent comparison with dynamic thresholds to determine anomalies.

[0036] In the anomaly detection module, the drift distance is compared with a dynamic threshold. When the drift distance exceeds the dynamic threshold, it is determined to be abnormal behavior, and an alarm signal is output, specifically including: Determine the dynamic threshold: Sort the drift distances corresponding to all sample points in the historical topologically invariant manifold coordinate set in ascending order, and take the value corresponding to the 99th percentile as the initial dynamic threshold. Simultaneously, every 100 real-time window of telemetry data received without triggering any abnormal alarms, the drift distance of the current window is included in the historical sequence, and the 99th percentile is recalculated to update the dynamic threshold. This update process uses a sliding window approach, retaining the most recent 1000 normal drift distance values.

[0037] During online detection, the drift distance calculated in real time is compared with the current dynamic threshold. If the drift distance is greater than the dynamic threshold, the telemetry data for the current window is determined to correspond to abnormal behavior; if the drift distance is less than or equal to the dynamic threshold, it is determined to be normal behavior. For windows determined to have normal behavior, their drift distance is used for the next update of the dynamic threshold.

[0038] When an abnormal behavior is detected, an alarm signal is immediately output. This alarm signal includes a timestamp of the abnormality and the sequence number of the abnormal window. The alarm signal is sent to the alarm recording unit of the power control system in the form of a digital switch signal, and an alarm prompt is displayed on the local monitor. If three consecutive windows are determined to be abnormal behaviors, an emergency alarm signal is output, which triggers a buzzer to sound and locks the alarm status until manually reset.

[0039] The working principle of this invention is as follows: First, normal telemetry data of each node in the power control system under various operating conditions are collected. A common embedding function is obtained through training with a three-layer graph convolutional layer of a deep equilateral neural network, superimposed with node permutation invariant regularization terms and contrastive loss. This function maps telemetry data of the same physical state under different topologies to three-dimensional topologically invariant manifold coordinates. Then, a probability density distribution is constructed on the historical manifold coordinate set using kernel density estimation, and the 95% region with the highest probability density is selected as the region occupied by normal behavior. Real-time telemetry data is collected online and mapped to real-time manifold coordinates through the same common embedding function. The drift distance is calculated by searching for the nearest boundary point from the coordinate point to the boundary of the normal region and extending it inward by one unit step. Finally, the drift distance is compared with a dynamic threshold. When the drift distance exceeds the threshold, it is determined as abnormal behavior and an alarm signal is output, thereby realizing the automatic identification of abnormal behavior in the power control system without relying on the explicit topology structure.

[0040] The same physical state refers to the deviation of active power, reactive power, and voltage amplitude at each node being within ±2%. Positive sample pairs are generated by simulation or collected from periods where steady-state operating data before and after planned switching operations are identical.

[0041] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. An automated identification system for abnormal behavior in power industrial control systems based on deep learning, characterized in that, include: The data acquisition module is used to collect normal telemetry data of each node of the power control system under various operating conditions. The normal telemetry data includes: three-phase voltage, active power, reactive power and frequency. The manifold alignment training module performs manifold alignment training on normal telemetry data to obtain a common embedding function. The common embedding function maps telemetry data with the same physical state under different topologies to neighboring coordinates in the embedding space, and outputs topology-invariant manifold coordinates. The normal region construction module maps normal telemetry data into a historical topological invariant manifold coordinate set through a common embedding function, and uses kernel density estimation to construct the region occupied by the normal behavior of the corresponding coordinate set in the embedding space. The real-time mapping and drift calculation module collects real-time telemetry data online, calculates the real-time manifold coordinates through a common embedding function, and measures the drift distance of the real-time manifold coordinates from the area occupied by normal behavior. The anomaly detection module compares the drift distance with a dynamic threshold. When the drift distance exceeds the dynamic threshold, it is determined to be an abnormal behavior and an alarm signal is output.

2. The automated identification system for abnormal behavior of power industrial control systems based on deep learning according to claim 1, characterized in that, The construction process of the public embedding function is as follows: The three-phase voltage and power values ​​in normal telemetry data are used as input features and input into the first graph convolutional layer of a deep equilateral neural network. After extracting local neighborhood correlations, the first intermediate feature is output. The first intermediate feature is input into the second graph convolutional layer, and a learnable node permutation invariant regularization term is superimposed to output the second intermediate feature. The second intermediate feature is mapped to low-dimensional manifold coordinates through a third graph convolutional layer, and contrastive loss is used to constrain the proximity of coordinates of the same physical state under different topologies to obtain a common embedding function.

3. The automated identification system for abnormal behavior of power industrial control systems based on deep learning according to claim 1, characterized in that, The output process of the topologically invariant manifold coordinates is as follows: Normal telemetry data are grouped by time window, the voltage phase angle difference sequence between nodes in each group is calculated, and the second to fourth order statistical moments of the voltage phase angle difference sequence are extracted as local invariant descriptors. Perform local linear alignment on the descriptors of adjacent windows to construct an initial estimate of the global low-dimensional coordinates; By minimizing the reconstruction error of all window descriptors in the low-dimensional space, the coordinates are iteratively updated until convergence, and the output is the coordinates of the topologically invariant manifold.

4. The automated identification system for abnormal behavior of power industrial control systems based on deep learning according to claim 3, characterized in that, The initial estimate for constructing the global low-dimensional coordinates specifically includes: The descriptor of the first time window is selected as the global reference anchor point, and its low-dimensional coordinates are set as the zero vector; For each subsequent adjacent window, solve for the local linear transformation coefficients between the adjacent window descriptor and the previous window descriptor, so as to minimize the Euclidean distance between the transformed descriptor and the previous window descriptor. The coefficients of the current window descriptor are mapped to the low-dimensional coordinate space of the previous window through a local linear transformation, and the initial estimate of the global low-dimensional coordinates of all windows is obtained by recursion.

5. The automated identification system for abnormal behavior of power industrial control systems based on deep learning according to claim 1, characterized in that, The process for identifying the area occupied by normal behavior is as follows: Each coordinate point in the historical topological invariant manifold coordinate set is taken as a sample point. The Euclidean distance between each sample point and its k-th nearest neighbor sample point is calculated, and the median of all distances is taken as the initial bandwidth. A Gaussian kernel function is constructed with each sample point as the center and the initial bandwidth as the radius. The probability density distribution in the embedding space is obtained by summing all kernel functions. The 95% region with the highest probability density value is selected as the region occupied by normal behavior, and the remaining regions are marked as potential abnormal regions.

6. The automated identification system for abnormal behavior of power industrial control systems based on deep learning according to claim 5, characterized in that, The output process of the probability density distribution is as follows: For each sample point, calculate the average distance between the sample point and its three nearest neighbors, and use the ratio of the average distance to the initial bandwidth as the kernel function scaling factor; An isotropic Gaussian kernel function is constructed with the sample point as the center and the product of the scaling factor and the initial bandwidth as the radius. The embedding space is discretized into a uniform grid, and the values ​​of all Gaussian kernel functions are accumulated at each grid node. After normalization, the probability density distribution is output.

7. The automated identification system for abnormal behavior of power industrial control systems based on deep learning according to claim 1, characterized in that, The process of measuring the drift distance is as follows: Determine the location of the real-time manifold coordinates in the embedding space, and search for the nearest boundary point to the boundary of the region occupied by the normal behavior. Calculate the direction of the line connecting the location point and the nearest boundary point, and extend the line direction into the region by one unit step to obtain the reference point. The Euclidean distance between the location point and the reference point is used as the drift distance. If the location point is located within the region, the drift distance is taken as a negative value.

8. The automated identification system for abnormal behavior of power industrial control systems based on deep learning according to claim 7, characterized in that, The search process for the nearest boundary point is as follows: Construct a hypersphere with the location point as the center and the initial radius set to half the minimum distance between all sample points in the embedding space; Gradually increase the radius of the hypersphere, and after each increase, check whether the hypersphere contains the boundary point of the area occupied by normal behavior, until the first boundary point is detected. The point closest to the location point among all detected boundary points is determined as the nearest boundary point.

Images