A meter box abnormal power consumption feature extraction and monitoring method

Abstract

The present application belongs to the technical field of electric power monitoring, and particularly relates to a metering box abnormal power consumption feature extraction and monitoring method, comprising: obtaining metering box data and constructing a multi-dimensional feature vector containing current, voltage, power factor and power consumption increment; when constructing an isolation forest, assigning a split weight according to the sum of feature kurtosis skewness absolute value, and non-uniformly selecting a split feature dimension; determining a sampling probability on the selected dimension according to the reciprocal of the probability density value and randomly selecting a split point; calculating the path score and initial abnormal score of the to-be-tested sample in the isolation forest; determining k topological nearest neighbors by counting the co-occurrence frequency; representing the local topological cohesion degree by the average co-occurrence frequency; obtaining an abnormal power consumption score by fusing the initial abnormal score and the cohesion degree, and determining that there is abnormal power consumption if the score exceeds a preset monitoring threshold. The present application realizes high-precision and high-stability monitoring of metering box abnormal power consumption behavior in a complex high-dimensional power consumption scene.

Description

Technical Field

[0001] This invention relates to the field of power monitoring technology. More specifically, this invention relates to a method for extracting and monitoring abnormal power consumption characteristics of a metering box. Background Technology

[0002] As a crucial node connecting a vast number of users at the end of the power grid, the stability of the metering box's operation and the compliance of its electricity consumption directly affect the safe and reliable operation of the power grid and the fairness and impartiality of electricity metering. Faced with massive, high-dimensional electricity monitoring data from metering boxes, the industry typically introduces machine learning models for automated anomaly detection. The Isolation Forest algorithm is one such mainstream and efficient anomaly detection technique. The core idea of ​​this algorithm is that anomalies are more easily isolated than normal points. Therefore, when dividing the data space by constructing multiple trees, anomalies are usually quickly isolated, located on shorter paths closer to the root node.

[0003] In practical monitoring applications, electricity consumption data from metering boxes is often highly complex. On the one hand, genuine anomalies such as equipment malfunctions and electricity theft are easily hidden within a large amount of redundant information, such as voltage and current fluctuations. On the other hand, in massive amounts of electricity consumption data, genuine anomalies are often accompanied by strong local isolation characteristics. Traditional isolation forests rely solely on global path depth, and when faced with complex and redundant features, the isolation index at the global dimension is easily diluted. This requires monitoring models to have the ability to accurately extract redundant features and to strengthen and double-verify the isolation of anomalies by combining local topological relationships between data.

[0004] Chinese patent application CN111178396A discloses a method and device for identifying users with abnormal electricity consumption. This solution obtains users' historical electricity consumption data and uses the standard isolated forest algorithm to calculate the abnormal electricity consumption score, thereby realizing the automated identification and screening of users with abnormal electricity consumption and providing a monitoring means for preventing theft and leakage in the power system.

[0005] Referring to the above technical solution, this approach directly adopts the standard isolated forest algorithm, randomly selecting splitting features and splitting points when constructing the isolation tree. When faced with complex bin data containing a large number of redundant features, this blind random splitting fails to consider the differences in the contribution of different feature dimensions to anomaly detection, easily leading to low splitting efficiency and affecting detection accuracy and convergence speed. Furthermore, the anomaly scoring in this approach relies solely on the global metric of the sample's path length in the tree, completely ignoring the local topological relationships and density distribution information between data samples. Under these circumstances, anomaly judgment relies only on the single metric of global path length, ignoring the local topological relationships between data samples. It lacks a targeted enhancement mechanism for anomalies that also exhibit strong isolated characteristics in the local space, making it difficult to meet the high-contrast, high-precision monitoring requirements in complex scenarios. Summary of the Invention

[0006] To address the technical problems of insufficient detection accuracy and efficiency caused by the completely random selection of split features and split points in existing technologies, and the susceptibility to misjudgment or missed judgment due to ignoring local topological cohesion information by relying solely on global path length, this invention provides a method for extracting and monitoring abnormal power consumption features of metering boxes.

[0007] This invention provides a method for extracting and monitoring abnormal electricity consumption features of a metering box, comprising: S1: acquiring electricity consumption data of the metering box within a preset time period, and constructing a multi-dimensional feature vector containing current, voltage, power factor, and the electricity consumption increment calculated by the difference between the electricity consumption in the current period and the electricity consumption in the previous period; S2: constructing an isolated forest model, and assigning selection weights to each feature dimension based on the sum of the absolute values ​​of kurtosis and skewness of the current node data sample in each feature dimension during the splitting of isolated tree nodes, and non-uniformly selecting the splitting feature dimension according to the selection weights; S3: estimating the probability density distribution of the data samples on the selected splitting feature dimensions, calculating the sampling probability based on the reciprocal of the probability density value of each point within the range of data sample values, and then... S4: Randomly select a split point based on the sampling probability in the split feature dimension; S5: Calculate the path score and initial anomaly score of the test data sample in the isolated forest; S6: Calculate the co-occurrence frequency of the test data sample falling into the same leaf node with other samples in all isolated trees, and determine the k samples with the highest co-occurrence frequency as the k topological nearest neighbors of the test data sample; S7: Calculate the average co-occurrence frequency of the test data sample with the k topological nearest neighbors as an indicator of local topological cohesion; S8: Based on the initial anomaly score and the local topological cohesion index of the test data sample, obtain the abnormal power consumption score. When the abnormal power consumption score exceeds the preset monitoring threshold, it is determined that there is abnormal power consumption in the metering box.

[0008] By adopting the above technical solution, this invention overcomes the problems of significantly reduced splitting efficiency and negative impact on detection accuracy and convergence speed caused by the completely random selection of features in traditional isolated forests. It utilizes non-uniform selection of splitting feature dimensions based on kurtosis and skewness, and non-uniform selection of splitting points based on probability density distribution. At the same time, by extracting the initial anomaly score of the global dimension and the local topological cohesion index of the local dimension for fusion calculation, it makes up for the limitation of existing anomaly evaluation systems that rely solely on global path scores. By introducing local topological cohesion to significantly enhance the significance of isolated anomaly points, and combining the dual verification of global path and local density, it greatly improves the contrast and accuracy of anomaly detection, thereby achieving high-precision and high-stability monitoring of abnormal power consumption behavior of metering boxes in complex and high-dimensional power consumption scenarios.

[0009] Preferably, the step of assigning selection weights to each feature dimension based on the sum of the absolute values ​​of kurtosis and skewness of the current node's data samples in each feature dimension, and non-uniformly selecting the splitting feature dimension according to the selection weights, includes: calculating the kurtosis and skewness of each feature dimension i for the data samples within the current node; adding the absolute values ​​of kurtosis and skewness of each feature dimension i as the selection weight of the feature dimension; normalizing the selection weights of each feature dimension to obtain the selection probability of each feature dimension; and using a roulette wheel selection method to select one feature dimension from all feature dimensions as the splitting feature dimension according to the selection probability.

[0010] By adopting the above technical solution, the present invention can use the sharpness and symmetry of data distribution as statistical indicators to measure the ability to distinguish dimensions, so that the model can focus on the feature dimensions with more abnormal exposure during the node splitting process, and remove the interference of a large number of redundant or irrelevant features, thereby further improving the efficiency and pertinence of the isolation tree in isolating real abnormal features.

[0011] Preferably, the estimation of the probability density distribution of the data sample, based on the reciprocal of the probability density value of each point within the range of data sample values, calculates the sampling probability, and randomly selects a split point on the splitting feature dimension according to the sampling probability, including: using a Gaussian kernel density estimation algorithm to estimate the probability density of the data sample points on the selected splitting feature dimension to obtain a probability density distribution function; uniformly generating multiple candidate split points within the range of data sample values ​​of the current node, and calculating the probability density value of each candidate split point using the probability density distribution function; calculating the reciprocal of the sum of the probability density value of each candidate split point and a preset minimum value, as the selection weight of the corresponding candidate split point; normalizing the selection weight of each candidate split point to obtain a sampling probability, and randomly selecting one from the candidate split points as a split point using a roulette wheel selection method according to the sampling probability.

[0012] By adopting the above technical solution, the present invention eliminates the clustering interference of high-density central regions on the selection of split points, improves the model's efficiency in dividing abnormal samples, and introduces a preset minimum constant to participate in the reciprocal calculation to ensure the stable operation of the program and prevent division-by-zero errors.

[0013] Preferably, the calculation of the path score and initial anomaly score of the test data sample in the isolated forest includes: for the test data sample, traversing each isolated tree in the isolated forest to obtain the traversal path of the test data sample from the root node to the leaf node; counting the number of split nodes traversed on the traversal path; using the number of split nodes as the path score of the test data sample in the isolated tree; calculating the arithmetic mean of the path scores of the test data sample in all isolated trees as the expected path score; and using the reciprocal of the sum of the expected path score and a preset minimum constant as the initial anomaly score.

[0014] By adopting the above technical solution, the present invention can intuitively reflect the sparsity of data samples in the global space, laying a safe and reliable foundation for the subsequent fusion of local density features for global anomaly assessment.

[0015] Preferably, the step of statistically analyzing the co-occurrence frequency of the test data sample falling into the same leaf node with other samples in all isolation trees, and determining the k samples with the highest co-occurrence frequency as the k topological nearest neighbors of the test data sample, includes: inputting the test data sample into each isolation tree, recording the occurrence count of all samples within the leaf node to which the test data sample belongs in each isolation tree; summing the occurrence counts of the test data sample with all corresponding samples to obtain the accumulated co-occurrence count; dividing the accumulated co-occurrence count by the total number of isolation trees to obtain the co-occurrence frequency of the test data sample with each sample and excluding the test data sample itself; sorting the co-occurrence frequencies in descending order, and selecting the samples corresponding to the k highest co-occurrence frequencies after sorting as the k topological nearest neighbors of the test data sample.

[0016] By adopting the above technical solution, the present invention can accurately locate the local neighborhood structure most closely related to the data sample to be tested from the dynamic high-dimensional space, eliminate the interference of irrelevant samples with distant relationships on the subsequent cohesion calculation, and provide key data support for accurately evaluating the local correlation between samples.

[0017] Preferably, the step of calculating the average co-occurrence frequency of the test data sample and its k topological nearest neighbors as an indicator of local topological cohesion includes: obtaining the co-occurrence frequency values ​​of the test data sample and its k topological nearest neighbors; adding the k co-occurrence frequency values ​​together and dividing by the number of topological nearest neighbors k to calculate the arithmetic mean of the k co-occurrence frequency values; and using the arithmetic mean as an indicator of the local topological cohesion of the test data sample.

[0018] Preferably, obtaining the abnormal power consumption score based on the initial anomaly score and the local topological cohesion index of the test data sample includes: using the initial anomaly score of the test data sample as the numerator; using the sum of the local topological cohesion index of the test data sample and a preset smoothing coefficient as the denominator; and dividing the numerator by the denominator to obtain the abnormal power consumption score.

[0019] Preferably, after constructing a multidimensional feature vector containing current, voltage, power factor, and the difference between the electricity consumption in the current cycle and the electricity consumption in the previous cycle, the method further includes: performing dimensionless processing on each dimension of the multidimensional feature vector using the maximum-minimum normalization method; subtracting the minimum feature value of the dimension among all samples from the original feature value in the multidimensional feature vector, and then dividing by the difference between the maximum and minimum feature values ​​of the dimension to obtain the normalized feature value after dimensionless processing.

[0020] Preferably, the step of using the Gaussian kernel density estimation algorithm to estimate the probability density of data sample points on the selected splitting feature dimension to obtain the probability density distribution function includes: constructing a Gaussian kernel function centered on each data sample and performing a weighted average to fit a continuous probability density distribution function; wherein, the bandwidth parameter required by the Gaussian kernel density estimation algorithm is determined using Scott's rule.

[0021] Specifically, the bandwidth parameter satisfies the following relationship:

[0022] in, Indicates bandwidth parameter; Indicates the sample size of the data sample; This indicates the number of feature dimensions in which the kernel density estimation is performed, and ; This represents the standard deviation of the data sample subset within the current split node across the selected split feature dimension.

[0023] Preferably, before determining that the meter box has abnormal power consumption, the method further includes a step of determining a preset monitoring threshold, including: extracting known normal power consumption data within a historical time period as a benchmark test set; calculating the abnormal power consumption score of all samples in the benchmark test set; and selecting a preset high quantile value in the abnormal power consumption score distribution of the benchmark test set as the preset monitoring threshold.

[0024] The technical solution of the present invention has the following beneficial technical effects: In constructing the isolated forest model, this invention utilizes kurtosis and skewness to assign selection weights to each feature dimension, enabling the model to prioritize features with more discriminative data distribution. Simultaneously, this invention selects split points based on probability density distribution estimation, guiding the splitting process within sparse data regions, thereby improving the efficiency and accuracy of isolating real anomaly samples. Furthermore, this invention characterizes local topological cohesion by calculating the topological co-occurrence frequency of samples in the isolated forest and deeply integrates this indicator with the global path score, overcoming the technical limitation of traditional isolated forest algorithms that rely solely on a single global indicator, resulting in insufficient discriminative power for anomaly scoring. This mechanism combines global sparsity and local cohesion for dual verification, enhancing the system's ability to identify abnormal electricity consumption behavior, reducing the risk of normal electricity consumption behavior being misjudged as abnormal, and improving the accuracy of extracting abnormal electricity consumption features from metering boxes and the reliability of monitoring results. Attached Figure Description

[0025] Figure 1 This is a flowchart of a method for extracting and monitoring abnormal power consumption characteristics of a metering box according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the split point probability density and sampling probability in an embodiment of the present invention; Figure 3 This is a schematic diagram of the topological nearest neighbor co-occurrence frequency distribution of the sample under test in an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the relationship between abnormal power consumption fraction and local topological cohesion in an embodiment of the present invention. Detailed Implementation

[0026] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0027] This invention discloses a method for extracting and monitoring abnormal power consumption characteristics of a metering box, referring to... Figure 1 This includes steps S1-S7: S1: Obtain electricity consumption data and construct a multidimensional feature vector.

[0028] The electricity consumption data within a preset time period of the metering box is obtained and constructed into a multi-dimensional feature vector that includes current, voltage, power factor, and the electricity consumption increment calculated by the difference between the electricity consumption in the current period and the electricity consumption in the previous period.

[0029] In an optional embodiment, firstly, using Structured Query Language (SQL), data on current, voltage, power factor, and cumulative electricity consumption for a specified metering box within a preset time period, such as every 15 minutes over the past 24 hours, are queried from an electricity marketing database or a real-time monitoring database. Here, current, voltage, and power factor are all average values ​​within that 15-minute time window. Subsequently, the cumulative electricity consumption data is differentially calculated by subtracting the previous cumulative electricity consumption from the current cumulative electricity consumption at the previous time point, resulting in a new feature of the electricity consumption increment. The four features—current, voltage, power factor, and electricity consumption increment—corresponding to each time point are combined into a multi-dimensional feature vector, thus constructing a multi-dimensional feature vector set containing multiple data samples. Finally, for each dimension of this multi-dimensional feature vector set, a minimax normalization method is used for dimensionless processing. This is calculated by subtracting the minimum eigenvalue of that dimension from all samples in the original eigenvalue of the multi-dimensional feature vector, and then dividing by the difference between the maximum and minimum eigenvalues ​​of that dimension, resulting in a dimensionless normalized feature value.

[0030] In this way, this step eliminates the numerical differences between features of different dimensions, providing a standardized data foundation for the accurate construction of the subsequent isolated forest model and the extraction of abnormal features.

[0031] S2: Based on non-uniform selection of splitting features based on kurtosis and skewness.

[0032] An isolation forest model is constructed. In the splitting of isolation tree nodes, selection weights are assigned to each feature dimension based on the sum of the absolute values ​​of kurtosis and skewness of the current node's data samples in each feature dimension. The splitting feature dimension is then selected non-uniformly according to the selection weights.

[0033] In an optional embodiment, during the recursive splitting process of constructing each isolation tree, the statistical properties of the subset of data samples contained in the node to be split are calculated across all four feature dimensions. Kurtosis and skewness are used as specific metrics to characterize these statistical properties because they reflect the sharpness and symmetry of the data distribution. Outliers typically cause peaks and long tails in the distribution, increasing the absolute values ​​of these two metrics. Therefore, the skew function can be used to calculate each feature dimension separately. skewness And use the kurtosis function to calculate each feature dimension peak It should be noted that the input data used here to calculate kurtosis and skewness are the normalized feature values ​​after dimensionless processing in step S1. Next, each feature dimension... skewness absolute value and kurtosis The absolute values ​​are added together and used as the selection weights for the feature dimensions. .

[0034] Specifically, the weights are chosen to satisfy the following relation:

[0035] in, This represents the selection weight for the feature dimension, and its value is a non-negative real number. Kurtosis represents the feature dimension, and its value ranges from real numbers; This represents the skewness of the feature dimension, and its value ranges from real numbers. .

[0036] After calculating the selection weights for all four feature dimensions, the selection weights for each feature dimension are normalized to obtain the selection probability for each feature dimension. Its calculation logic is to assign selection weights to the feature dimensions. Divide by the sum of the selection weights of all feature dimensions.

[0037] Specifically, the probability of selection satisfies the following relationship:

[0038] in, This represents the probability of selecting a feature dimension, and its value ranges from 0 to 1. This represents the selection weight for the feature dimension, and its value is a non-negative real number. This represents the sum of the selection weights for all feature dimensions, and its value ranges from positive real numbers.

[0039] Next, based on the selection probability of each feature dimension The cumulative probability is calculated by sequentially summing the selection probabilities from the first feature dimension to the current feature dimension. For example, if the kurtosis of the current dimension within the current node is 4.5 and the skewness is -2.1, then the calculated selection weight for the current dimension is 6.6. After calculating the weights for all four dimensions, such as the selection weight for the current dimension being 6.6, the selection weight for the voltage dimension being 1.2, the selection weight for the power factor dimension being 3.5, and the selection weight for the electricity consumption increment dimension being 8.1, these weights are normalized. Taking the above values ​​as an example, the total weight is 19.4, so the calculated selection probability for the current dimension is 0.34, and the cumulative probability for each dimension is calculated accordingly. Finally, a random number in the range [0,1] is generated using the roulette wheel selection method. By comparing random numbers The probability of splitting is determined by the cumulative probability of each feature dimension, or by using the choice function with a selection probability parameter, and randomly selecting one feature dimension from all feature dimensions non-uniformly, so that the feature with the larger selection weight has a higher probability of being selected.

[0040] Thus, by using kurtosis and skewness to non-uniformly distribute weights across each feature dimension, this step enables the model to prioritize splitting into anomalous dimensions with more discriminative data distribution, thereby improving the efficiency and accuracy of the isolation tree in isolating real anomalous features.

[0041] S3: Based on probability density estimation, select the corresponding split point.

[0042] Estimate the probability density distribution of the data samples on the selected splitting feature dimension, calculate the sampling probability based on the reciprocal of the probability density value of each point within the range of data sample values, and randomly select a splitting point on the splitting feature dimension according to the sampling probability.

[0043] In an optional embodiment, to make the split points more likely to fall in sparse data regions, a Gaussian kernel density estimation algorithm is used to continuously estimate the probability density of data sample points for the selected split feature dimension within the current node. This is achieved by constructing a Gaussian kernel function centered at each sample point and performing a weighted average to fit a continuous probability density distribution function. Among them, the bandwidth parameter required by the Gaussian kernel density estimation algorithm The mean square error of the estimate is determined using an empirical rule known as Scott's rule in kernel density estimation, so that the mean square error of the estimate is asymptotically optimal.

[0044] Specifically, the bandwidth parameter satisfies the following relationship:

[0045] in, This represents the bandwidth parameter, and its value range is positive real numbers; This represents the sample size of the data sample, and its value ranges from positive integers. This indicates the number of feature dimensions on which the kernel density estimation is performed. Since the kernel density estimation is performed only on the single selected splitting feature dimension, its value is 1 in this step. This represents the standard deviation of the data sample subset within the current split node on the selected split feature dimension. It can be obtained by calculating the arithmetic square root of the variance of the local data under that specific feature dimension, and its value range is a non-negative real number.

[0046] Establish a continuous probability density distribution function Then, uniform sampling is performed within the data values ​​[min, max] of this splitting feature dimension to generate a fixed number of candidate splitting points. For example, generating 100 candidate split points. Next, using the constructed continuous probability density distribution function... Calculate each candidate split point Corresponding probability density value .

[0047] Specifically, the probability density values ​​satisfy the following relationship:

[0048] in, This represents the probability density value of a candidate split point, and its value ranges from non-negative real numbers. This represents a continuous probability density distribution function; This represents a candidate split point, and its value range is a real number.

[0049] Since outliers are typically located in low-density regions, the sampling probability is determined based on the reciprocal of the probability density value. To prevent division-by-zero errors when the probability density value is 0, each candidate split point is calculated. probability density value With a preset minimum value The reciprocal of the sum is used as the corresponding candidate split point. Initial sampling selection weights For the preset minimum value For example, the possible values ​​are .

[0050] Specifically, the initial sampling selection weights satisfy the following relationship:

[0051] in, This represents the initial sampling selection weight for candidate split points, and its value ranges from positive real numbers. This represents the probability density value of a candidate split point, and its value ranges from non-negative real numbers. This represents the preset minimum value used to prevent division by zero errors, and its value range is positive real numbers.

[0052] Calculate all candidate split points Initial sampling selection weights Then, weights are selected for all initial samples. Normalization is performed to obtain each candidate split point. final sampling probability Finally, based on the obtained sampling probability distribution, a weighted random sampling method is used, such as calling the `choice` function or using a roulette wheel selection method, to select from the 100 generated candidate split points. The data sample of the current node is divided into two child nodes: left and right, by randomly selecting a point uniformly and non-uniformly as the final split point.

[0053] Specifically, the sampling probability satisfies the following relationship:

[0054] in, This represents the sampling probability of a candidate split point, and its value ranges from 0 to 1; This represents the initial sampling selection weight of the candidate split point currently being calculated, and its value ranges from positive real numbers; This represents the sum of the initial sampling selection weights of all candidate split points generated in the current dimension, and its value range is a positive real number.

[0055] Thus, this step, by using Gaussian kernel density estimation to fit the data distribution and assigning higher sampling selection weights to candidate split points in low-density regions, allows outliers located at the edges of the data distribution or in sparse regions to be selected as split points earlier and with a higher probability, improving the efficiency of the isolation tree in isolating and segmenting outlier samples. Figure 2 As shown, the sampling probability increases in sparse data regions and decreases in high-density central regions, achieving non-uniform priority selection of split points.

[0056] S4: Calculate the path score and initial anomaly score of the sample to be tested.

[0057] For the test data sample, calculate the path score and initial anomaly score of the test data sample in the isolated forest.

[0058] In an optional embodiment, after the isolated forest model is constructed, for a sample of data to be tested... The sample of data to be tested Each isolation tree in the pre-built isolation forest model is input into In the middle, the tree index The total number of isolation trees from 1 to 2. In each isolation tree In the middle, the data sample to be tested Starting from the root node, the test data sample is determined based on the splitting features and splitting points defined for each splitting node. Determine whether to assign the node to the left or right child node, and recursively proceed downwards along the path until a final leaf node is reached. Record the number of split nodes traversed from the root node to that leaf node, and denote this number of split nodes as the test data sample. In the isolation trees Path score For example, the total number of isolation trees. If set to 100, the data sample to be tested is in the first isolation tree. If a path reaches a leaf node after passing through 8 split nodes, the calculated path score is... The score is 8; if 7 split nodes are traversed in the second isolation tree, the calculated path score is... The value is 7. After traversing all... isolation trees After that, we get a set containing A set of path scores. Next, the test data samples are calculated. The arithmetic mean of the path scores on all isolated trees in the isolated forest is used as the sample of the test data. Expected path score throughout the isolated forest .

[0059] Specifically, the expected path score satisfies the following relation:

[0060] in, This represents the expected path score of the test data sample in the entire isolated forest, and its value range is a non-negative real number. Indicates the data sample to be tested is in the th... The path score in the isolated tree, whose value is a non-negative integer; This represents the total number of isolated trees in the isolated forest, and its value is a positive integer. The index represents the isolated tree, and its value ranges from 1 to... Positive integers.

[0061] Because outliers are typically more easily isolated than normal samples, their paths in the isolation tree are shorter, resulting in a lower expected path score. The score will be smaller, therefore, the expected path score will be lower. The reciprocal of the result is used as the sample of the test data. initial abnormal score Specifically, to prevent division by zero errors caused by the test data sample being isolated at the root node in extreme cases, resulting in a desired path score of 0, a preset minimum constant is introduced in the denominator when calculating the reciprocal. Perform smoothing processing.

[0062] Specifically, the initial anomaly scores satisfy the following relation:

[0063] in, This represents the initial anomaly score of the data sample to be tested, and its value ranges from positive real numbers. This represents the expected path score of the test data sample in the entire isolated forest, and its value range is a non-negative real number. This represents a preset minimum constant used to prevent division by zero errors. Its value range is positive real numbers. In this embodiment, the preset minimum constant is... .

[0064] In this way, this step stably transforms the difficulty of data samples being isolated into specific global anomaly evaluation indicators, providing a safe and reliable scoring basis for subsequent fusion of local density features.

[0065] S5: Statistically determine co-occurrence frequencies and identify topological nearest neighbors.

[0066] The co-occurrence frequency of the test data sample falling into the same leaf node with other samples in all isolation trees is statistically analyzed, and the k samples with the highest co-occurrence frequency are determined as the k topological nearest neighbors of the test data sample.

[0067] In an optional embodiment, during the training phase, a sparse data structure of size is initialized to store the number of times sample pairs co-occur. co-occurrence matrix ,in The co-occurrence matrix is ​​initially set to the total number of training samples. All elements of the matrix are set to zero. Next, all isolated trees in the isolated forest are traversed. For each leaf node in each tree, the indices of all samples falling into that leaf node are obtained. If a leaf node contains multiple samples, such as sample A, sample B, and sample C, then all possible sample pairs (sample A and sample B, sample A and sample C, sample B and sample C) are counted pairwise. Specifically, any two different samples falling into a leaf node are counted. With sample The combination of these elements in the co-occurrence matrix The count value corresponding to the lieutenant general's position and count value Add 1 to each.

[0068] After traversing all isolation trees, the co-occurrence matrix is... Each element in the co-occurrence matrix represents the total number of occurrences for the corresponding sample pair. Next, the co-occurrence matrix... The total number of occurrences of each sample pair recorded in the data divided by the total number of isolation trees in the isolated forest. The co-occurrence frequencies of each sample pair are obtained, and a normalized co-occurrence frequency matrix is ​​formed. In this embodiment, the total number of isolation trees... If the value is 100, then all element values ​​in the matrix are normalized by dividing by 100.

[0069] Specifically, the co-occurrence frequencies of sample pairs satisfy the following relationship:

[0070] in, This represents the co-occurrence frequency of a sample pair, ranging from 0 to 1, and indicates the probability that any two training samples fall into the same leaf node. This represents the total number of occurrences of corresponding sample pairs recorded in the co-occurrence matrix, and its value ranges from non-negative integers. This represents the total number of isolation trees in the isolated forest, and its value is a positive integer.

[0071] For the data sample to be tested The test data samples are obtained using a dynamic calculation method. The co-occurrence frequency with each training sample. Specifically, the test data samples... Input each isolation tree to obtain the data sample to be tested. Record the sample data to be tested at the leaf node to which each tree belongs. For each training sample ID belonging to a leaf node in each tree, count the occurrences of all training samples appearing in that leaf node. Next, process the test data samples... The co-occurrence count is summed with the count of occurrence in the corresponding training sample. After traversing all trees, the summed co-occurrence count is divided by the total number of isolation trees. To obtain the test data sample The co-occurrence frequency vector with each training sample.

[0072] Specifically, the co-occurrence frequencies satisfy the following relationship:

[0073] in, Indicates the difference between the sample data to be tested and the first... The co-occurrence frequency of each training sample, with a value ranging from 0 to 1; Indicates the difference between the sample data to be tested and the first... The cumulative co-occurrence count of a training sample in all leaf nodes, whose value is a non-negative integer; This represents the total number of isolation trees in the isolated forest, and its value is a positive integer.

[0074] After obtaining the co-occurrence frequency vector, the co-occurrence frequency values ​​in the vector are sorted in descending order. Then, the highest-ranking values ​​are found... This is a co-occurrence frequency value. The sample corresponding to each frequency value is the data sample to be tested. of The number of topological nearest neighbors. In this embodiment, the number of topological nearest neighbors... The preferred value is 10, meaning that the top 10 samples with the highest co-occurrence frequency after sorting are selected as the test data samples. The 10 topological nearest neighbors.

[0075] It should be noted that the total number of isolation trees and the number of topological nearest neighbors are algorithm hyperparameters, and their specific values ​​can be adaptively adjusted according to the data volume of the input electricity consumption data. Typically, the total number of isolation trees can be set between 100 and 300, and the number of topological nearest neighbors can be set between one-thousandth and one-hundredth of the total number of samples to balance anomaly detection accuracy and computational cost.

[0076] Thus, this step extends the previously isolated scoring system, which relied solely on global path depth, to the field of local topological structure evaluation, laying a crucial data foundation for the subsequent accurate quantification of local correlations and cohesion among data samples.

[0077] S6: Calculate the average co-occurrence frequency to obtain the local topological cohesion.

[0078] The average co-occurrence frequency of the test data sample with the k topological nearest neighbors is calculated as an indicator of local topological cohesion.

[0079] In an optional embodiment, the test data sample determined according to the foregoing steps of Find the topological nearest neighbors to obtain the test data samples. and The co-occurrence frequency values ​​of each neighboring sample. Next, the above... Add up the co-occurrence frequency values ​​and divide by the number of topological nearest neighbors. Calculate the arithmetic mean of this set of co-occurrence frequencies. This arithmetic mean is defined as the frequency of the test data sample. Local topological cohesion Local topological cohesion It indicates the degree of similarity between a sample and its close neighbors.

[0080] Specifically, the local topological cohesion satisfies the following relationship:

[0081] in, This represents the local topological cohesion of the data sample under test, and its value ranges from 0 to 1. Indicates the difference between the sample data to be tested and the first... The co-occurrence frequency values ​​of the topological nearest neighbors, which range from 0 to 1; This represents the number of topological nearest neighbors, and its value is a positive integer. The sorted index represents the topological nearest neighbor, and its value ranges from 1 to... Positive integers.

[0082] Preferably, the number of topological nearest neighbors The value is 10, after the sample of data to be tested has been determined. After finding the 10 topological nearest neighbors, these 10 topological nearest neighbors are sequentially denoted as nearest neighbor samples. to nearest neighbor samples Data samples to be tested The co-occurrence frequency values ​​corresponding to the above 10 nearest neighbor samples are denoted as co-occurrence frequency values. To co-occurrence frequency value For example, the data sample to be tested. Nearest neighbor samples The co-occurrence frequency value was 0.78, and the test data sample... Nearest neighbor samples The co-occurrence frequency value is 0.75. At this time, a certain data sample to be tested... The frequency distribution of the 10 topological nearest neighbors is as follows: Figure 3 As shown, the co-occurrence frequencies are arranged in descending order, and the average value calculated based on this distribution is the local topological cohesion of the sample. Physically, if a sample is a normal point, it will frequently fall into the same leaf node as surrounding normal points, resulting in a high average co-occurrence frequency with its topological nearest neighbors, indicating strong local topological cohesion. Conversely, if a sample is an outlier, its co-occurrence frequency with any other sample is relatively low, leading to a low average co-occurrence frequency, indicating weak local topological cohesion.

[0083] Thus, this step characterizes the local topological cohesion of the data samples, making up for the technical shortcomings of relying solely on global path scores which are easily diluted by multidimensional features, and further highlighting the true isolated outliers under the local cohesion index.

[0084] S7: Calculate the abnormal power consumption score and determine the abnormal power consumption.

[0085] Based on the initial anomaly score and the local topological cohesion index of the data sample to be tested, the abnormal power consumption score is obtained. When the abnormal power consumption score exceeds the preset monitoring threshold, it is determined that there is abnormal power consumption in the metering box.

[0086] In an optional embodiment, to combine global sparsity and local cohesion for more accurate anomaly identification, the test data samples are... initial abnormal score With local topological cohesion Perform fusion calculations. Due to local topological cohesion... Located in the denominator, to prevent local topological cohesion When the value is extremely small or zero, it can cause calculation overflow and division by zero errors. A preset smoothing coefficient is introduced into the denominator. Specifically, the data samples to be tested initial abnormal score As molecules, local topological cohesion With preset smoothing coefficient The sum of the two is used as the denominator, and the two are divided to obtain the combined abnormal electricity consumption fraction. In this embodiment, a preset smoothing coefficient is used. Values .

[0087] From the perspective of core principles, for a typical outlier, its initial outlier score is... Larger local topological cohesion The smaller value resulted in a lower calculated abnormal electricity consumption score. Very large; for a normal point, its initial outlier score is... Smaller local topological cohesion The value is relatively large, resulting in a higher calculated abnormal electricity consumption score. Smaller. That is, the lower the local cohesion, the higher the outlier score; the higher the local cohesion, the lower the outlier score. This score mapping relationship is as follows: Figure 4 As shown.

[0088] Specifically, the abnormal electricity consumption fraction satisfies the following relationship:

[0089] in, This represents the abnormal electricity consumption score of the data sample to be tested, and its value range is a non-negative real number; This represents the initial anomaly score of the data sample to be tested, and its value ranges from positive real numbers. This represents the local topological cohesion of the data sample under test, and its value ranges from 0 to 1. This represents the preset smoothing coefficient used to prevent division by zero, and its value range is positive real numbers.

[0090] Obtain abnormal power consumption score Then, the calculated abnormal electricity consumption fractions will be... With a preset monitoring threshold Compare. If abnormal power consumption is found... Greater than the preset monitoring threshold If the metering box exhibits abnormal power consumption behavior within the preset time period, an alarm will be triggered. In this embodiment, the preset monitoring threshold... Set to 0.85, for abnormal power consumption fractions An alarm will be triggered if the value is greater than 0.85.

[0091] It should be noted that the preset monitoring threshold is not a fixed constant, but can be dynamically set according to the business tolerance of false alarm rate and false negative rate based on the actual monitoring scenario. The specific method is as follows: extract known normal electricity consumption data within a historical time period as a benchmark test set, calculate the abnormal electricity consumption score of all samples in the benchmark test set, and select a high quantile value in the score distribution, such as 95%, as the preset monitoring threshold; or the value can be determined based on expert experience combined with cross-validation.

[0092] In this way, this step solves the technical pain point of traditional isolated forests relying on a single indicator, which leads to insufficient differentiation of abnormal scores, and realizes high-precision and high-stability monitoring and alarm of abnormal power consumption behavior of metering boxes.

[0093] To verify the effectiveness of each improved module in this scheme, control and ablation experiments were conducted. The experimental setup consisted of an Intel Core i7 processor and 32GB of RAM, and Python 3.8 with the Scikit-learn library. The dataset used was the publicly available Thyroid anomaly detection benchmark dataset, which contained 3.5% of the samples as anomalies. All isolated forest models had 100 trees, with a subsample size of 256. The experiments included a standard isolated forest as the baseline model, and three ablation models: Model 1 removed only the local topological cohesion score adjustment module; Model 2 removed only the split point selection module based on kernel density estimation; and Model 3 removed only the feature selection module based on kurtosis and skewness. AUC and F1 score were used as evaluation metrics.

[0094] Experimental results show that the standard isolated forest model has an AUC of 0.885 and an F1 score of 0.762; Model 1 has an AUC of 0.921 and an F1 score of 0.835; Model 2 has an AUC of 0.930 and an F1 score of 0.854; Model 3 has an AUC of 0.938 and an F1 score of 0.867; while the complete solution model integrating all improved modules achieves an AUC of 0.953 and an F1 score of 0.891. Compared to the standard isolated forest, the complete solution of this invention improves the AUC and F1 score by 6.8 percentage points and 12.9 percentage points, respectively. Compared with the complete scheme and Model 1, the local topological cohesion score adjustment module brought a 3.2 percentage point improvement in AUC; compared with the complete scheme and Model 2, the split point selection strategy based on kernel density estimation contributed a 2.3 percentage point improvement in AUC; compared with the complete scheme and Model 3, the feature selection strategy based on kurtosis and skewness contributed a 1.5 percentage point improvement in AUC. This fully demonstrates the superiority and effectiveness of prioritizing splitting on the dimension of data distribution anomalies, guiding the splitting of sparse regions, and integrating local cohesion in the extraction of abnormal electricity consumption features.

[0095] Figure 2This diagram illustrates the probability density of split points and the sampling probability in an embodiment of the present invention. The bell-shaped curve represents the probability density distribution; the flat curve, high at both ends and low in the middle, represents the sampling probability distribution. The bulges and dips in the curves represent the magnitude of the values, and the legend shows the physical indicators corresponding to different curves.

[0096] As can be seen from the image, the sampling probability curve does not exhibit a synchronized spike with the probability density curve, but rather shows a completely opposite trend. This proves that the algorithm successfully removed data aggregation interference in high-density areas and did not incorrectly prioritize sampling the central dense area. Observing the intersection area of ​​the two curves, it can be found that the lower the probability density amplitude, the higher the sampling probability amplitude; as it moves towards the central high-density area, the sampling probability amplitude rapidly decreases and remains low. This corresponds to the physical characteristics described in the specific implementation method: the sampling probability increases in sparse data areas and decreases in high-density central areas.

[0097] Figure 3 This is a schematic diagram of the topological nearest neighbor co-occurrence frequency distribution of the test sample in an embodiment of the present invention. The stepped-down bars in the diagram represent the co-occurrence frequency values ​​of the test data sample and each topological nearest neighbor sample. The height of the bars represents the magnitude of the co-occurrence frequency value, and the horizontal arrangement order represents the descending ranking of the nearest neighbor samples.

[0098] The image shows that the multiple bars do not exhibit random fluctuations, but rather a strict decreasing trend. This proves that the algorithm successfully screened and determined the local neighborhood structure most closely related to the test data sample, and did not incorrectly include irrelevant samples with distant relationships in the cohesion calculation. Observing the bars at the top of the left-hand sorting, it can be found that the earlier the sorting index, the taller the bar; as the sorting index increases, the bar height decreases in an orderly manner. This corresponds to the physical characteristics described in the specific implementation method of sorting the co-occurrence frequency values ​​in descending order and selecting the k highest frequency values ​​for local topological cohesion evaluation.

[0099] Figure 4 This diagram illustrates the relationship between abnormal power consumption fraction and local topological cohesion in an embodiment of the present invention. The curve showing a monotonically decreasing trend represents the mapping relationship between abnormal power consumption fraction and local topological cohesion. The horizontal extension of the curve represents an increase in local cohesion strength, while the vertical drop of the curve represents a decrease in abnormal power consumption fraction.

[0100] The graph shows that the abnormal power consumption score does not change linearly with the local topological cohesion, but rather exhibits a non-linear decay state similar to an inverse proportional function. This proves that the algorithm successfully integrates global sparsity and local cohesion, and does not erroneously amplify the risk of misclassifying local high-density normal points as abnormal. Observing the initial region on the left side of the curve, it can be seen that the lower the local topological cohesion, the more sharply the abnormal power consumption score increases; as the local topological cohesion increases, the abnormal power consumption score decreases rapidly and eventually tends to level off. This corresponds to the physical characteristics described in the specific implementation: the lower the local cohesion, the higher the abnormal score, and the higher the local cohesion, the lower the abnormal score.

[0101] It should be noted that those skilled in the art can make various modifications and improvements without departing from the inventive concept, and these all fall within the scope of protection of this invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A method for extracting and monitoring abnormal power consumption characteristics of a metering box, characterized in that, include: S1: Obtain electricity consumption data from the metering box within a preset time period, and construct a multi-dimensional feature vector containing current, voltage, power factor, and the electricity consumption increment calculated from the difference between the electricity consumption in the current period and the electricity consumption in the previous period; S2: Construct an isolated forest model, and in the splitting of isolated tree nodes, assign selection weights to each feature dimension based on the sum of the absolute values ​​of kurtosis and skewness of the current node's data sample in each feature dimension, and non-uniformly select the splitting feature dimension according to the selection weights; S3: Estimate the probability density distribution of the data sample on the selected splitting feature dimension, calculate the sampling probability based on the reciprocal of the probability density value of each point within the range of data sample values, and randomly select a splitting point on the splitting feature dimension according to the sampling probability; S4: For the data sample to be tested, calculate the path score and initial anomaly score of the data sample to be tested in the isolated forest; S5: Calculate the co-occurrence frequency of the test data sample falling into the same leaf node with other samples in all isolation trees, and determine the k samples with the highest co-occurrence frequency as the k topological nearest neighbors of the test data sample; S6: Calculate the average co-occurrence frequency of the test data sample with the k topological nearest neighbors as an indicator of local topological cohesion; S7: Based on the initial anomaly score of the test data sample and the local topological cohesion index, obtain the abnormal power consumption score. When the abnormal power consumption score exceeds the preset monitoring threshold, it is determined that there is abnormal power consumption in the metering box.

2. The method for extracting and monitoring abnormal power consumption characteristics of a metering box according to claim 1, characterized in that, The step of assigning selection weights to each feature dimension based on the sum of the absolute values ​​of kurtosis and skewness of the current node's data samples across each feature dimension, and then non-uniformly selecting the splitting feature dimension according to the selection weights, includes: calculating the kurtosis and skewness of each feature dimension i for the data samples within the current node; adding the absolute values ​​of kurtosis and skewness of each feature dimension i as the selection weight of the feature dimension; normalizing the selection weights of each feature dimension to obtain the selection probability of each feature dimension; and using a roulette wheel selection method to select one feature dimension from all feature dimensions as the splitting feature dimension according to the selection probability.

3. The method for extracting and monitoring abnormal power consumption characteristics of a metering box according to claim 1, characterized in that, The estimation of the probability density distribution of the data sample involves calculating the sampling probability based on the reciprocal of the probability density values ​​of each point within the range of data sample values, and randomly selecting a split point on the splitting feature dimension according to the sampling probability. This includes: using a Gaussian kernel density estimation algorithm to estimate the probability density of the data sample points on the selected splitting feature dimension to obtain a probability density distribution function; uniformly generating multiple candidate split points within the range of data sample values ​​of the current node, and calculating the probability density value of each candidate split point using the probability density distribution function; calculating the reciprocal of the sum of the probability density values ​​of each candidate split point and a preset minimum value, using this as the selection weight for the corresponding candidate split point; normalizing the selection weights of each candidate split point to obtain a sampling probability, and randomly selecting one from the candidate split points as a split point using a roulette wheel selection method based on the sampling probability.

4. The method for extracting and monitoring abnormal power consumption characteristics of a metering box according to claim 1, characterized in that, The calculation of the path score and initial anomaly score of the test data sample in the isolated forest includes: for the test data sample, traversing each isolated tree in the isolated forest to obtain the traversal path of the test data sample from the root node to the leaf node; counting the number of split nodes traversed on the traversal path; using the number of split nodes as the path score of the test data sample in the isolated tree; calculating the arithmetic mean of the path scores of the test data sample on all isolated trees as the expected path score; and using the reciprocal of the sum of the expected path score and a preset minimum constant as the initial anomaly score.

5. The method for extracting and monitoring abnormal power consumption characteristics of a metering box according to claim 1, characterized in that, The method involves statistically analyzing the co-occurrence frequency of the test data sample in all isolation trees when it falls into the same leaf node as other samples. The k samples with the highest co-occurrence frequencies are then identified as the k topological nearest neighbors of the test data sample. This process includes: inputting the test data sample into each isolation tree and recording the occurrence count of all samples within the leaf node to which the test data sample belongs in each isolation tree; summing the occurrence counts of the test data sample with all corresponding samples to obtain the accumulated co-occurrence count; dividing the accumulated co-occurrence count by the total number of isolation trees to obtain the co-occurrence frequency of the test data sample with each sample, excluding the test data sample itself; sorting the co-occurrence frequencies in descending order and selecting the samples corresponding to the k highest co-occurrence frequencies as the k topological nearest neighbors of the test data sample.

6. The method for extracting and monitoring abnormal power consumption characteristics of a metering box according to claim 1, characterized in that, The step of calculating the average co-occurrence frequency of the test data sample with its k topological nearest neighbors as an indicator of local topological cohesion includes: obtaining the co-occurrence frequency values ​​of the test data sample with its k topological nearest neighbors; adding the k co-occurrence frequency values ​​together and dividing by the number of topological nearest neighbors k to calculate the arithmetic mean of the k co-occurrence frequency values; and using the arithmetic mean as an indicator of the local topological cohesion of the test data sample.

7. The method for extracting and monitoring abnormal power consumption characteristics of a metering box according to claim 1, characterized in that, The process of obtaining the abnormal power consumption score based on the initial anomaly score and the local topological cohesion index of the test data sample includes: using the initial anomaly score of the test data sample as the numerator; using the sum of the local topological cohesion index of the test data sample and a preset smoothing coefficient as the denominator; and dividing the numerator by the denominator to obtain the abnormal power consumption score.

8. The method for extracting and monitoring abnormal power consumption characteristics of a metering box according to claim 1, characterized in that, After constructing a multidimensional feature vector containing current, voltage, power factor, and the difference between the electricity consumption in the current cycle and the electricity consumption in the previous cycle, the method further includes: performing dimensionless processing on each dimension of the multidimensional feature vector using the maximum-minimum normalization method; subtracting the minimum feature value of the dimension among all samples from the original feature value in the multidimensional feature vector, and then dividing by the difference between the maximum and minimum feature values ​​of the dimension to obtain the normalized feature value after dimensionless processing.

9. The method for extracting and monitoring abnormal power consumption characteristics of a metering box according to claim 3, characterized in that, The method of using the Gaussian kernel density estimation algorithm to estimate the probability density of data sample points on the selected splitting feature dimension to obtain the probability density distribution function includes: constructing a Gaussian kernel function centered on each data sample and performing a weighted average to fit a continuous probability density distribution function; wherein, the bandwidth parameter required by the Gaussian kernel density estimation algorithm is determined by Scott's rule. Specifically, the bandwidth parameter satisfies the following relationship: in, Indicates bandwidth parameter; Indicates the sample size of the data sample; This indicates the number of feature dimensions in which the kernel density estimation is performed, and ; This represents the standard deviation of the data sample subset within the current split node across the selected split feature dimension.

10. The method for extracting and monitoring abnormal power consumption characteristics of a metering box according to claim 1, characterized in that, Before determining that the meter box has abnormal power consumption, the method further includes the step of determining a preset monitoring threshold, which includes: extracting known normal power consumption data within a historical time period as a benchmark test set; calculating the abnormal power consumption score of all samples in the benchmark test set; and selecting a preset high quantile value in the abnormal power consumption score distribution of the benchmark test set as the preset monitoring threshold.

Images