A power stealing detection method, an intelligent metering switch and a power consumption information acquisition terminal

Abstract

The present application relates to electricity stealing detection technical field, specifically provide a kind of electricity stealing detection method, intelligent measurement switch and electric information acquisition terminal, method includes: the original user data of acquisition intelligent electric meter, based on original user data, calculate electricity data dispersion degree;Based on electricity data dispersion degree, establish and maintain long-term benchmark and short-term benchmark, long-term benchmark is indexed according to time period and is updated recursively with weighting, short-term benchmark is updated in real time using online exponential weighted moving average;Based on prediction error, time characteristics or dispersion degree volatility rate dynamically calculate comprehensive weight, based on comprehensive weight, the long-term benchmark and short-term benchmark are weighted and fused, obtain final benchmark;According to the deviation between electricity data dispersion degree and final benchmark, judge whether there is electricity stealing behavior.Utilize user data dispersion degree index to construct group consistency reference, effectively distinguish real electricity stealing behavior, significantly reduce the false positive rate caused by high-power equipment load fluctuation.

Description

Technical Field

[0001] This invention belongs to the field of electricity theft detection technology, and particularly relates to an electricity theft detection method, an intelligent measuring switch, and an electricity consumption information collection terminal. Background Technology

[0002] With the continuous advancement of smart grid construction, the coverage rate of electricity consumption information collection in low-voltage distribution substations has significantly improved, and digital measurement equipment, represented by smart meters, has been deployed on a large scale for residential and industrial users. However, electricity theft remains a significant problem hindering power operations. Electricity theft not only causes direct economic losses but may also lead to safety hazards such as substation line overload and phase sequence imbalance, affecting the safe operation of the power grid and the fair order of electricity use.

[0003] To address electricity theft, various detection methods are currently available, including physical inspection methods, which rely on manual inspections and on-site checks of electricity meter seals and wiring terminals; threshold detection methods, which issue alarms based on preset power or energy thresholds; single-user time-series analysis methods, which use time-series prediction models such as ARIMA and LSTM to fit and predict the electricity consumption curve of a single user, and identify anomalies through the residual between the actual and predicted values; machine learning methods, which use algorithms such as isolated forests, support vector machines, and convolutional neural networks to learn the characteristic patterns of electricity theft behavior in a supervised or semi-supervised manner; and group comparison methods, which are based on transformer area line loss analysis or synchronous line loss comparison, and judge the overall power loss by comparing the difference between the total meter reading of the transformer area and the sum of the readings of each sub-meter, and this method can reflect whether there is abnormal leakage in the transformer area.

[0004] However, the aforementioned existing technologies still have the following technical problems: fixed thresholds cannot adapt to seasonal changes and fluctuations in user habits, resulting in a significant increase in false alarm rates during peak summer and winter load periods; single-user time-series analysis lacks a group reference system, easily misjudging the start-up of normal high-power devices such as air conditioners and water heaters as electricity theft; machine learning methods rely on a large number of hard-to-obtain labeled samples and have high computational overhead, making them difficult to deploy on edge devices; group comparison methods can only perceive the overall loss of the transformer area and cannot accurately locate the specific user and phase where electricity theft occurs. Summary of the Invention

[0005] To address the problems existing in the prior art, the present invention provides a method for detecting electricity theft, comprising the following steps: Step S1: Collect the original user data of the smart meter, and calculate the dispersion of electricity consumption data based on the original user data; Step S2: Based on the dispersion of the electricity consumption data, establish and maintain a long-term benchmark and a short-term benchmark. The long-term benchmark is updated by weighted recursion according to the time period index, and the short-term benchmark is updated in real time using an online exponential weighted moving average. Step S3: Dynamically calculate the comprehensive weight based on prediction error, time characteristics, or dispersion volatility; and weight and fuse the long-term benchmark and the short-term benchmark based on the comprehensive weight to obtain the final benchmark. Step S4: Determine whether there is electricity theft based on the deviation between the dispersion of the electricity consumption data and the final benchmark.

[0006] Specifically, step S1, calculating the dispersion of electricity consumption data, includes: S1.1: Calculate the mean and standard deviation based on the original user data, and obtain the coefficient of variation, Gini coefficient and information entropy based on the mean and standard deviation; S1.2: The coefficient of variation, Gini coefficient and information entropy are weighted and summed to obtain the dispersion of electricity consumption data.

[0007] Based on the above scheme, the update method for the long-term benchmark in step S2 is as follows: The arithmetic mean of the dispersion of user data within the current time window is calculated using the first recursive formula: Update the long-term benchmark for the current time window; Where d(t) is ∈[0,6], representing a day from Monday to Sunday; h(t) is ∈[0,23], representing an hour within a day; (d(t), h(t)) represents the arithmetic mean of the dispersion of user data within the current hourly window; λ is the long-term smoothing coefficient; This represents the current long-term benchmark value; This represents the long-term baseline value before the update.

[0008] Based on the above scheme, the update method for the short-term benchmark in step S2 is as follows: The second recursive formula is used: Update the short-term benchmark value at the current time point; Where D(t) is the dispersion of user data at the current moment, and α is the short-term smoothing coefficient. This is the short-term baseline value from the previous moment.

[0009] Preferably, step S3, dynamically calculating the comprehensive weight, includes: The first weight is calculated based on the prediction errors of the long-term and short-term benchmarks; The second weight is calculated based on the time period to which the current time belongs; The third weight is calculated based on the standard deviation of the sliding window of user data dispersion; The first, second, and third weights are summed to obtain the comprehensive weight.

[0010] Based on the above scheme, the first weight is calculated based on the prediction error, specifically including: The long-term benchmark prediction error is calculated based on the long-term benchmark and the dispersion of user data, and the short-term benchmark prediction error is calculated based on the short-term benchmark and the dispersion of user data. The first weight is calculated based on the long-term benchmark prediction error and the short-term benchmark prediction error.

[0011] Based on the above scheme, a second weight is calculated according to the time period to which the current time belongs, specifically including: Set a baseline weight to determine whether the current time belongs to a preset specific time period, which includes at least peak electricity consumption periods, weekends, and seasonal transition periods; If it belongs to a specific time period, the product of each time rule function value and its corresponding weight is accumulated to obtain the weight adjustment amount; The second weight is obtained based on the baseline weight and the weight adjustment amount.

[0012] Based on the above scheme, the third weight is calculated based on the sliding window standard deviation, specifically including: The standard deviation of the sliding window based on the mean of the dispersion is calculated, and the third weight is obtained based on the preset maximum weight and the standard deviation of the sliding window based on the dispersion.

[0013] Preferably, step S4 specifically includes: Determine whether a single point of anomaly exists based on the deviation between the dispersion of the electricity consumption data and the final baseline: , in, As the final benchmark, Let K be the standard deviation of the sliding window for the dispersion, and K be the multiplier. Determine if there are consecutive single points of anomaly; if so, determine if electricity theft has occurred.

[0014] On the other hand, the present invention also provides an intelligent measurement switch, comprising: The data acquisition and dispersion calculation module acquires the original user data of the smart meter and calculates the dispersion of electricity consumption data based on the original user data. The benchmark maintenance module establishes and maintains long-term and short-term benchmarks based on the dispersion of the electricity consumption data. The long-term benchmark is updated by weighted recursion according to the time period index, and the short-term benchmark is updated in real time using online exponential weighted moving average. The weight fusion module dynamically calculates the comprehensive weight based on prediction error, time characteristics, or dispersion volatility, and then weights and fuses the long-term benchmark and the short-term benchmark based on the comprehensive weight to obtain the final benchmark. The electricity theft detection module determines whether electricity theft has occurred based on the deviation between the dispersion of the electricity consumption data and the final benchmark.

[0015] In another aspect, the present invention also provides an electricity information collection terminal, including a processor, a memory, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the above-mentioned electricity theft detection method.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. By using the dispersion index of user data to construct a group consistency reference, the detection of electricity theft does not require labeled samples, effectively distinguishing between normal high-power equipment startup and real electricity theft behavior, and significantly reducing the false alarm rate caused by load fluctuations of high-power equipment; 2. A long-term and short-term benchmark coordination mechanism is adopted, and the comprehensive weight is dynamically adjusted in combination with multiple factors, so that the final benchmark can adaptively match the changes in season, time period and user habits, avoiding the accuracy changes caused by fixed weights; 3. A dynamic threshold is constructed based on the standard deviation of the sliding window, which, together with continuous anomaly confirmation, enables the detection threshold to be adaptively adjusted according to the data distribution. Single-point noise interference is eliminated through continuous anomalies over multiple cycles, thereby reducing the false alarm rate while maintaining a high detection rate. Attached Figure Description

[0017] Figure 1 This is a flowchart of the electricity theft detection method of the present invention; Figure 2 This is a flowchart illustrating the electricity theft detection method of the present invention. Detailed Implementation

[0018] The invention will be further described below with reference to specific embodiments.

[0019] like Figure 1 and Figure 2 As shown, the present invention provides a method for detecting electricity theft, comprising the following steps: Step S1: Collect the original user data of the smart meter, and calculate the dispersion of electricity consumption data based on the original user data; wherein, the original user data includes active power, reactive power, current, voltage, electricity consumption and power factor.

[0020] In this embodiment, electricity consumption data from user smart meters is collected via HPLC or RS485 communication, with a preset time window T as the period. In one possible implementation, T is 15 minutes, and raw user data is collected every 15 minutes.

[0021] Specifically, calculating the dispersion of electricity consumption data includes: S1.1: Calculate the mean and standard deviation based on the original user data, and obtain the coefficient of variation, Gini coefficient and information entropy based on the mean and standard deviation; First, the original data for user i at time t is: ,in, Active power Reactive power To accumulate electricity, For microcurrent, For voltage, Power factor; Secondly, in step S1.1, the original data also needs to be normalized to obtain the electricity consumption data: , Among them, the maximum value of the original data .

[0022] Calculate the mean and standard deviation based on user data: , , Where μ(t) is the mean, σ(t) is the standard deviation, and N is the number of users.

[0023] The coefficient of variation is: It is used to measure the relative fluctuation of electricity consumption data among users; The Gini coefficient is: X' is used to measure the degree of inequality in electricity consumption data among users, where X' j (t) represents the normalized electricity consumption data of the j-th user at time t; Information entropy is: , It is used to measure the uniformity of electricity distribution among users.

[0024] S1.2: The weighted sum of the coefficient of variation, Gini coefficient, and information entropy is used to obtain the dispersion of electricity consumption data: ; in, , , Calculate weights for the dispersion. .

[0025] In this embodiment, the weight for calculating the discreteness is set to =0.4、 =0.3、 =0.3, the three factors characterize group consistency from the perspectives of fluctuation amplitude, degree of inequality, and distribution uniformity, respectively. Through weighted fusion, the sensitivity to electricity theft can be improved while effectively suppressing false alarms caused by normal fluctuations.

[0026] Those skilled in the art can adjust the contribution ratio of the three factors according to the characteristics of the transformer area (such as user type, load level, etc.) to achieve scenario-adaptive discreteness calculation.

[0027] Step S2: Based on the dispersion of electricity consumption data, establish and maintain long-term and short-term benchmarks. The long-term benchmark is updated by weighted recursion according to the time period index, and the short-term benchmark is updated in real time using online exponential weighted moving average, respectively capturing long-term patterns and recent dynamics. S2.1, the long-term benchmark is updated as follows: Calculate the arithmetic mean of the dispersion of user data within the current time window, using the first recursive formula, and update the long-term baseline value of the current time window according to the time period index: ; In this embodiment, d(t) is ∈[0,6], representing a day from Monday to Sunday; h(t) is ∈[0,23], representing a certain hour of a day; (d(t), h(t)) represents the arithmetic mean of the dispersion of user data within the current hourly window; λ is the long-term smoothing coefficient, λ∈(0, 1); This represents the current long-term benchmark value; This represents the long-term baseline value before the update.

[0028] Since the data collection period in this embodiment is 15 minutes, the current hourly window contains four user data dispersions, and their arithmetic mean is the arithmetic mean of the four user data dispersions; λ is set to 0.3; when the first recursive formula is updated for the first time, it is directly set to... .

[0029] The long-term benchmark uses recursive weighted smoothing, which allows the benchmark to slowly follow the long-term changes in electricity consumption patterns. A value of 0.3 for λ means that the current window mean has a low weight, while the historical accumulated information has a high weight, thus ensuring the stability of the benchmark.

[0030] S2.2: The short-term benchmark is updated as follows: The second recursive formula is used to update the short-term benchmark value at the current time point: ; Where D(t) is the dispersion of user data at the current time, and α is the short-term smoothing coefficient, α=0.7. This is the short-term reference value from the previous moment. In this embodiment, α > λ, making the short-term reference more sensitive to current dispersion changes and enabling rapid response to sudden load changes in the distribution area.

[0031] Step S3: Dynamically calculate the comprehensive weight based on prediction error, time characteristics, or dispersion volatility; and weight and fuse the long-term benchmark and the short-term benchmark based on the comprehensive weight to obtain the final benchmark. S3.1: First, calculate the first weight based on the prediction errors of the long-term benchmark and the short-term benchmark; S3.11: Calculate the long-term benchmark prediction error based on the dispersion of long-term benchmark and user data: ; In the formula for calculating the long-term benchmark prediction error, d(t) 1) and h(t) 1) Let μ represent the day of the week and hour at time t-1, respectively. LTBM (d(t 1),h(t 1)) is the historical baseline corresponding to time t-1, D(t) 1) is t The measured dispersion at time 1 is not contradictory in time, and the required long-term benchmark prediction error can be obtained.

[0032] The long-term benchmark prediction error formula is the prediction deviation of the long-term benchmark for the dispersion of actual user data in the previous period. When the long-term benchmark prediction error is large, the long-term benchmark is invalid, indicating that the current electricity consumption behavior is significantly different from the normal situation in the same period of history. When the long-term benchmark prediction error is small, the long-term benchmark is valid, and the electricity consumption behavior conforms to historical patterns.

[0033] S3.12: Simultaneously calculate the short-term benchmark prediction error based on both the short-term benchmark and the user data dispersion; ; Similarly, μ STBM (d(t 1),h(t 1)) is the historical baseline corresponding to time t-1, D(t) 1) is the measured dispersion at the previous sampling time. The two do not conflict in time and can obtain the required short-term benchmark prediction error.

[0034] The short-term benchmark in this embodiment reflects the electricity consumption fluctuation pattern over the past 15 minutes. The short-term benchmark prediction error is the prediction deviation of the short-term benchmark on the dispersion of actual user data at the previous moment. When the short-term benchmark prediction error is large, it indicates that the short-term benchmark has undergone unexpected changes. When the short-term benchmark prediction error is small, it indicates that the electricity consumption behavior continues the recent pattern.

[0035] S3.13: Calculate the first weight based on the long-term benchmark forecast error and the short-term benchmark forecast error: ; Where δ represents the amount of zero-value prevention, and can be 0.001.

[0036] When the long-term benchmark fails, i.e. If the value is close to 0, the system switches to relying on a short-term benchmark. When the short-term benchmark experiences abnormal fluctuations, i.e. If the value is close to 1, it will automatically revert to the long-term benchmark, thus achieving complementarity between the two benchmarks.

[0037] S3.2: Calculate the second weight based on the time period to which the current time belongs, specifically including: S3.21: Set the baseline weight β base Determine whether the current time belongs to a preset specific time period. The preset specific time periods include nighttime (0-5 am), morning and evening peak hours (7-9 am, 5-8 pm), weekends, and seasonal transition periods (March, June, September, and December). S3.22: If it belongs to a preset specific time period, the following rules apply: Rule 1: Time rule function corresponding to nighttime hours , ; Rule 2: Time-based rule function corresponding to morning and evening rush hours , ; Rule 3: Corresponding to weekends, time rule function , ; Rule 4: Time rule function corresponding to the seasonal transition period , ; Values ​​of each time rule function Its corresponding weight The products are summed to obtain the weight adjustment amount: ; S3.23: Obtain the second weight based on the baseline weight and the weight adjustment amount: ; In this embodiment, The weight is set to 0.6 because the final comprehensive weight applies to the long-term benchmark. Therefore, the larger the comprehensive weight, the more trust the long-term benchmark is placed on it. The load pattern is stable during the nighttime hours, so the long-term benchmark is placed on it more. The load pattern changes more during the morning and evening peak hours, weekends, and seasonal transitions, so the short-term benchmark is placed on it more.

[0038] S3.3: Calculate the third weight based on the sliding window standard deviation of user data dispersion, specifically including: S3.31: Calculate the sliding window standard deviation of dispersion based on the sliding window mean of user data dispersion: ; ; Where L is the size of the sliding window, with a default of 24 time points (the sampling period in this embodiment is 15 minutes, corresponding to 6 hours). The mean of the sliding window. This represents the standard deviation of the sliding window.

[0039] S3.32: The third weight is obtained based on the preset maximum weight and the standard deviation of the sliding window of the dispersion. ; in, The maximum weight is set to 0.8 in this embodiment, and k is the scaling factor, which is set to 1.0 in this embodiment.

[0040] The standard deviation of the sliding window calculated in step S3.3 represents the dispersion volatility within the L time window. The greater the volatility, the more unstable the user's electricity consumption behavior is, and the more trust the short-term benchmark is placed in the user. The smaller the volatility, the more stable the user's electricity consumption behavior is, and the more trust the long-term benchmark is placed in the user.

[0041] S3.3: Sum the first, second, and third weights to obtain the overall weight: ; Where w1~w3 are the fusion weights, and in this embodiment, they are set as follows: w1=0.4, w2=0.3, w3=0.3; clamp() is a constraint function that restricts the output range to [0.1, 0.9].

[0042] According to the constraint function in this embodiment, if the weighted sum is less than 0.1, the output is set to 0.1; if the weighted sum is greater than 0.9, the output is set to 0.9; if the weighted sum is between [0.1, 0.9], the output remains unchanged, thereby avoiding the final benchmark from being completely dependent on a single benchmark.

[0043] S3.4: Obtain the final benchmark based on the comprehensive weights: .

[0044] In the formula for calculating the most accurate reference, μ LTBM (d(t), h(t)) and μ STBM (t) represents two independent estimates of the "normal value at time t" at different time scales. By integrating them with a comprehensive weight, a final benchmark can be obtained based on either benchmark.

[0045] In this embodiment, the comprehensive weight β(t) is dynamically calculated based on prediction error, time characteristics, or dispersion volatility. Long-term benchmarks are stable but slow to respond, while short-term benchmarks are sensitive but easily affected by noise. Through dynamic comprehensive weights, the system can adaptively bias towards a more reliable benchmark in different scenarios.

[0046] Step S4: Determine whether there is electricity theft based on the deviation between the dispersion of electricity consumption data and the final benchmark.

[0047] Specifically, it includes: S4.1: Determine if there are single-point anomalies based on the deviation between the dispersion of electricity consumption data and the final baseline. , in, As the final benchmark, The standard deviation of the sliding window is the short-term benchmark, and K is the multiplier. In this embodiment, K is set to 2, that is, when the current user data dispersion deviates from the final baseline value by more than two normal fluctuation steps, Abnormal(t)=1, and it is determined to be a single point of anomaly.

[0048] S4.2: Determine if there are consecutive single points of failure: Set continuous anomaly count ,like If the value is M, then it is determined that there is electricity theft; where M is the threshold for the number of consecutive abnormal events, and in this embodiment, M is set to 3.

[0049] Once electricity theft is determined, the theft information, meter number, etc., will be reported to the main station.

[0050] The single-point anomaly calculation of this invention is performed independently for each user. Therefore, each user has a corresponding independent long-term benchmark and short-term benchmark. Thus, users who steal electricity can be accurately located based on the single-point anomaly calculation.

[0051] Based on the same technical concept, the electricity theft detection method of the present invention is used in intelligent measuring switches or electricity information collection terminals, including: The data acquisition and dispersion calculation module collects raw user data from smart meters and calculates the dispersion of electricity consumption data based on the raw user data. The benchmark maintenance module establishes and maintains long-term and short-term benchmarks based on the dispersion of electricity consumption data. The long-term benchmark is updated by weighted recursion according to the time period index, while the short-term benchmark is updated in real time using online exponential weighted moving average. The weight fusion module dynamically calculates the comprehensive weight based on prediction error, time characteristics, or dispersion volatility, and then weights and fuses the long-term benchmark and the short-term benchmark based on the comprehensive weight to obtain the final benchmark. The electricity theft detection module determines whether electricity theft has occurred based on the deviation between the dispersion of electricity consumption data and the final benchmark.

[0052] In summary, this invention first collects electricity consumption data from multiple users under intelligent metering switches or electricity information collection terminals, and calculates a comprehensive dispersion index of the coefficient of variation, Gini coefficient, and information entropy to characterize the consistency of electricity consumption behavior from three dimensions: fluctuation amplitude, degree of inequality, and distribution uniformity. Second, it constructs long-term and short-term benchmarks to reflect the periodic patterns and recent dynamic changes in electricity consumption behavior, respectively. A comprehensive weight is dynamically calculated using prediction error, time characteristics, and dispersion volatility to achieve adaptive weighted fusion of the long-term and short-term benchmarks. Finally, a dynamic anomaly detection threshold is constructed using the sliding standard deviation, combined with a continuous anomaly counting mechanism to identify electricity theft. According to the method of this invention, no electricity theft labeling samples are required, and it can run in real time on edge devices. The use of group consistency constraints effectively reduces false alarms caused by the startup of normal high-power devices such as air conditioners and water heaters. The dual-benchmark fusion mechanism can adapt to complex scenarios such as seasonal changes, peak and off-peak periods, weekends and holidays, and load fluctuations. The computational complexity is low, involving only basic statistics and recursive operations, making it suitable for deployment on computing-constrained devices such as intelligent metering switches and electricity information collection terminals.

[0053] The electricity information collection terminal provided by this invention includes a processor, a memory, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of the electricity theft detection method described above. The processor can perform various actions and processes according to the program stored in the memory. Specifically, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor, and can be based on an x86 architecture or an ARM architecture.

[0054] The memory stores computer-executable instructions that, when executed by a processor, implement the aforementioned electricity theft detection method. The memory can be volatile or non-volatile, or may include both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct memory bus random access memory (DR RAM). It should be noted that the memory used in the methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0055] In general, various exemplary embodiments of the present invention can be implemented in hardware or dedicated circuitry, software, firmware, logic, or any combination thereof. Some aspects can be implemented in hardware, while others can be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device. When aspects of embodiments of the present invention are illustrated or described as block diagrams, flowcharts, or represented using certain other images, it will be understood that the blocks, apparatuses, systems, techniques, or methods described herein can be implemented as non-limiting examples in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or certain combinations thereof.

[0056] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0057] While the specific embodiments of the present invention have been described above, they are not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A method for detecting electricity theft, characterized in that, Includes the following steps: Step S1: Collect the original user data of the smart meter, and calculate the dispersion of electricity consumption data based on the original user data; Step S2: Based on the dispersion of the electricity consumption data, establish and maintain a long-term benchmark and a short-term benchmark. The long-term benchmark is updated by weighted recursion according to the time period index, and the short-term benchmark is updated in real time using an online exponential weighted moving average. The long-term benchmark is updated as follows: The arithmetic mean of the dispersion of user data within the current time window is calculated using the first recursive formula: Update the long-term benchmark for the current time window; Where d(t) is ∈[0,6], representing a day from Monday to Sunday; h(t) is ∈[0,23], representing an hour within a day; (d(t), h(t)) represents the arithmetic mean of the dispersion of user data within the current hourly window; λ is the long-term smoothing coefficient; This represents the current long-term benchmark value; This represents the long-term baseline value before the update; The short-term benchmark The update method is as follows: Using the second recursive formula: Update the short-term benchmark value at the current time point; Where D(t) is the dispersion of user data at the current moment, and α is the short-term smoothing coefficient. This is the short-term baseline value from the previous moment; Step S3: Dynamically calculate the comprehensive weight based on prediction error, time characteristics, and dispersion volatility. The final benchmark is obtained based on the comprehensive weights: ； The dynamic calculation of the comprehensive weight includes: The first weight is calculated based on the prediction errors of the long-term and short-term benchmarks; The second weight is calculated based on the time period to which the current time belongs; The third weight is calculated based on the standard deviation of the sliding window of user data dispersion; The first, second, and third weights are weighted and summed to obtain the comprehensive weight. Step S4: Determine whether there is electricity theft based on the deviation between the dispersion of the electricity consumption data and the final benchmark.

2. The electricity theft detection method according to claim 1, characterized in that, Step S1, which calculates the dispersion of electricity consumption data, includes: S1.1: Calculate the mean and standard deviation based on the original user data, and obtain the coefficient of variation, Gini coefficient and information entropy based on the mean and standard deviation; S1.2: The coefficient of variation, Gini coefficient and information entropy are weighted and summed to obtain the dispersion of electricity consumption data.

3. The electricity theft detection method according to claim 1, characterized in that, The first weight is calculated based on the prediction error, specifically including: The long-term benchmark prediction error is calculated based on the long-term benchmark and the dispersion of user data, and the short-term benchmark prediction error is calculated based on the short-term benchmark and the dispersion of user data. The first weight is calculated based on the long-term benchmark prediction error and the short-term benchmark prediction error.

4. The electricity theft detection method according to claim 1, characterized in that, The second weight is calculated based on the time period to which the current time belongs, specifically including: Set a baseline weight to determine whether the current time belongs to a preset specific time period, which includes at least peak electricity consumption periods, weekends, and seasonal transition periods; If it belongs to a specific time period, the product of each time rule function value and its corresponding weight is accumulated to obtain the weight adjustment amount; The second weight is obtained based on the baseline weight and the weight adjustment amount.

5. The electricity theft detection method according to claim 1, characterized in that, The third weight is calculated based on the sliding window standard deviation, specifically including: The standard deviation of the sliding window based on the mean of the dispersion is calculated, and the third weight is obtained based on the preset maximum weight and the standard deviation of the sliding window based on the dispersion.

6. The electricity theft detection method according to claim 1, characterized in that, Step S4 specifically includes: Determine whether a single point of anomaly exists based on the deviation between the dispersion of the electricity consumption data and the final baseline: ， in, As the final benchmark, Let K be the standard deviation of the sliding window for the dispersion, and K be the multiplier. Determine if there are consecutive single points of anomaly; if so, determine if electricity theft has occurred.

7. An intelligent measuring switch, characterized in that, include: The data acquisition and dispersion calculation module acquires the original user data of the smart meter and calculates the dispersion of electricity consumption data based on the original user data. The benchmark maintenance module establishes and maintains long-term and short-term benchmarks based on the dispersion of the electricity consumption data. The long-term benchmark is updated by weighted recursion according to the time period index, and the short-term benchmark is updated in real time using online exponential weighted moving average. The long-term benchmark is updated in the following way: The arithmetic mean of the dispersion of user data within the current time window is calculated using the first recursive formula: Update the long-term baseline of the current time window; where d(t) is ∈[0,6], representing a day from Monday to Sunday; h(t) is ∈[0,23], representing an hour within a day; (d(t), h(t)) represents the arithmetic mean of the dispersion of user data within the current hourly window; λ is the long-term smoothing coefficient; This represents the current long-term benchmark value; This represents the long-term baseline value before the update; The short-term benchmark The update method is as follows: Using the second recursive formula: Update the short-term baseline value at the current time point; where D(t) is the dispersion of user data at the current time, and α is the short-term smoothing coefficient. This is the short-term baseline value from the previous moment; The weight fusion module dynamically calculates the comprehensive weight based on prediction error, time characteristics, or dispersion volatility. The final benchmark is obtained based on the comprehensive weights: ； The dynamic calculation of the comprehensive weight includes: The first weight is calculated based on the prediction errors of the long-term and short-term benchmarks; The second weight is calculated based on the time period to which the current time belongs; The third weight is calculated based on the standard deviation of the sliding window of user data dispersion; The first, second, and third weights are weighted and summed to obtain the comprehensive weight. The electricity theft detection module determines whether electricity theft has occurred based on the deviation between the dispersion of the electricity consumption data and the final benchmark.

8. A power consumption information collection terminal, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the method as described in any one of claims 1-6.

Images