A power stealing identification method combined with multi-source data, medium and equipment

Abstract

The present application relates to electricity stealing detection technical field, especially in a kind of electricity stealing discrimination method of combined multi-source data, including the initial electricity stealing probability corresponding to the respective determination of a number of evidence source data based on user;Corresponding initial electricity stealing probability is generated by the synchronous correction of the initial electricity stealing probability corresponding to the respective determination of the bottom layer confidence and the upper layer confidence based on evidence source data;Global conflict coefficient representing the difference between different evidence source data is determined based on the basic electricity stealing probability, and initial user electricity stealing probability calculation formula is constructed, and confidence factor based on global conflict coefficient mapping is provided in initial user electricity stealing probability calculation formula.The present application effectively solves the problem of multi-source evidence conflict fusion by dynamically adjusting the weight of corresponding initial electricity stealing probability and self-adapting update of the upper layer and bottom layer confidence of evidence source data, and the weighted average information of conflict evidence is retained by confidence factor to avoid fusion paradox.

Description

Technical Field

[0001] This invention relates to the field of electricity theft detection, and in particular to a method, medium, and device for identifying electricity theft using multi-source data. Background Technology

[0002] With the deepening of smart grid construction, information platforms such as electricity information collection systems, metering automation systems, and line loss management systems have been widely used in power companies, providing a rich data foundation for anti-electricity theft work. However, electricity theft methods are becoming increasingly covert and technologically advanced, evolving from traditional meter bypassing and front-end wiring to current diversion theft, phase theft, and remote control theft, making traditional anti-electricity theft methods difficult to effectively counter.

[0003] Currently, the main problems with anti-electricity theft technology in the power industry are as follows: I. Isolated data from multiple sources makes it difficult to form a joint judgment. The various business systems within a power company (electricity consumption information collection, line loss management, metering automation, etc.) operate independently, with inconsistent data standards, creating information silos. Data such as load curves, line loss rates, and meter events cannot be analyzed collaboratively within a unified framework, resulting in a lack of complete evidence for determining electricity theft. Existing methods often rely on single-indicator analysis (such as looking only at abnormal current or excessive line loss), which is prone to false alarms due to non-theft factors such as equipment failure or weather changes.

[0004] II. Conflict Resolution Challenges in Multi-Source Evidence Fusion Dempster's evidence theory provides an effective tool for multi-source information fusion, but significant conflicts often arise between different evidence sources in anti-electricity theft scenarios. For example, abnormal user current data points to a high probability of electricity theft, while the line loss rate of the same transformer area is within the normal range due to non-theft factors such as line aging, leading to contradictory conclusions. Traditional Dempster's combination rules produce counterintuitive fusion results (i.e., paradoxes) when dealing with highly conflicting evidence, severely limiting the practical application of multi-source evidence fusion methods in the field of anti-electricity theft.

[0005] Third, there is a lack of a dynamic assessment mechanism for the credibility of evidence sources. In existing evidence-based methods, the credibility of each evidence source is often determined by fixed weights based on prior experience or global data, lacking a dynamic evaluation mechanism to address data quality fluctuations (such as missing load data, lightning interference, and meter clock deviations) and the historical accuracy of evidence sources. For example, the reliability of line loss data decreases significantly during thunderstorms or severe three-phase imbalances, and fixed-weight fusion methods cannot adapt to such changes, resulting in insufficient robustness of the fusion results.

[0006] Therefore, how to effectively handle conflicting evidence and dynamically evaluate the credibility of each evidence source in the fusion of multi-source data, so as to reduce the false alarm rate and improve the reliability of electricity theft detection, is a key technical problem that urgently needs to be solved in this field. Summary of the Invention

[0007] To address one of the aforementioned technical problems, this invention provides a method for detecting electricity theft using combined multi-source data, comprising the following: To obtain the initial probability of electricity theft, the corresponding initial probability of electricity theft is determined based on several types of evidence source data from the user. , where i represents the type number of the evidence source data, and A represents the proposition of electricity theft; Generate a basic probability of electricity theft and determine the corresponding underlying credibility based on the internal data characteristics of various evidence sources. The corresponding upper-level credibility is determined based on the historical hit rate of various evidence source data. Underlying credibility and upper-level credibility The initial probability of electricity theft corresponding to the weight synchronization correction. To generate the base probability of electricity theft ; Determine the initial user electricity theft probability based on the baseline electricity theft probability. Determine the global conflict coefficient representing the differences between data from different evidence sources. Initial user electricity theft probability The calculation formula is: , in, Based on global conflict coefficient The confidence factor obtained by mapping, where n represents the number of types of evidence source data.

[0008] Furthermore, the evidence source data includes user load time-series data, transformer area line loss data, and meter event data.

[0009] Furthermore, the first underlying reliability corresponding to the load time-series data is determined. This includes: acquiring the user load sequence within a first preset time period from the load time series data, and determining the standard deviation of the load sequence. and mean The ratio determines the actual coefficient of variation. The data missing rate is determined based on the corresponding load sequence and load sampling frequency within the second preset time period in the load time series data. First level of credibility The calculation formula is: , in, The default penalty coefficient is the missing value. The preset attenuation factor, The normal fluctuation threshold preset for the coefficient of variation. The preset fluctuation saturation threshold for the coefficient of variation.

[0010] Furthermore, the second underlying reliability corresponding to the line loss data of the transformer area is determined. This includes: obtaining the average three-phase current within the third preset time period from the transformer area line loss data. And climate information within a fourth preset time period, including the third preset time period, based on imbalance Determine the credibility correction factor Determining climate correction factors based on climate information Second underlying credibility The calculation formula is: .

[0011] Furthermore, the credibility correction factor The calculation formula is: .

[0012] Furthermore, the third underlying credibility corresponding to the meter event data is determined. This includes: obtaining the set of event occurrence times from meter event data within the fifth preset time period, and the set of user load change times from load time sequence data, and calculating the minimum time difference between the set of event occurrence times and the set of load change times. ; Obtain the number of false alarms within the sixth preset time period from the meter event data to determine the historical false alarm factor. Third underlying credibility The calculation formula is: , in, This is a preset time difference threshold.

[0013] Furthermore, the global conflict coefficient The calculation formula is: , in, .

[0014] Furthermore, based on the user's space adjustment factor Adjusting the initial user electricity theft probability To generate the probability of end-user electricity theft Compare the probability of electricity theft by end users Whether to generate a user's electricity theft alarm information is determined by the preset alarm threshold.

[0015] Furthermore, the spatial adjustment factor is determined. Includes: acquiring users Neighboring users, users Spatial residual of electricity consumption differences with neighboring users Determine whether it simultaneously meets the user's requirements. The initial user's probability of electricity theft is higher than the first threshold, and the spatial residual... If the second threshold is exceeded and the initial probability of electricity theft by neighboring users is lower than the third threshold, then it is a spatial adjustment factor. This is the first adjustment value; No, determine whether it simultaneously meets the user's requirements. If the positive and negative transition time difference of the load power of any user within the transformer area is lower than the corresponding time difference threshold, and the rate of change of the total load power of the transformer area within the overlapping interval of positive and negative transition times is lower than the fourth threshold, then it is a spatial adjustment factor. This is the second adjustment value; otherwise, it is a spatial adjustment factor. This is the third adjustment value.

[0016] Furthermore, the spatial residual is determined. This includes: acquiring voltage time-series data of each user in the load time-series data to calculate the correlation coefficient between each user, and constructing a spatial correlation graph between users with users as nodes and whether the correlation coefficient exceeds the correlation threshold as the association condition; User identification based on spatial association graph Neighboring users, users Its spatial residual The calculation formula is: , in, Indicates user The current load power at the current moment, Indicates user The set of neighboring users, Indicates user The median load power of all neighboring users at the current moment.

[0017] This invention has at least one of the following beneficial effects: (i) Transform the challenge of handling conflicts in multi-source evidence into an engineering-feasible fusion solution, significantly improving the accuracy of electricity theft detection. Determining underlying credibility based on user-generated evidence data. and upper-level credibility In order to synchronously correct the initial probability of electricity theft corresponding to the evidence source data. And generate the base probability of electricity theft. Underlying credibility The system includes quality indicators representing the internal conditions of the evidence source data (such as load missing rate and three-phase imbalance) and physical environment indicators representing the environment in which the evidence source data was collected (such as lightning weather and meter false alarm rate), which are dynamically adjusted to enhance upper-level credibility. This represents the historical hit rate of the evidence source data. Through a two-layer credibility correction (the lower layer is based on real-time data quality and physical environment indicators, and the upper layer is based on a sliding window statistics of historical hit rates), the initial electricity theft probability is dynamically and adaptively adjusted based on weights. This solves the problem of calculating the initial user's probability of electricity theft. In the process, fixed weights cannot adapt to the shortcomings caused by the fluctuations in the quality of data from different evidence sources.

[0018] Initial user electricity theft probability The formula includes a global conflict coefficient. Confidence factor of mapping Compared to the traditional Dempster rule, this invention avoids the counterintuitive normalization paradox when the global conflict coefficient K=1. Instead, it preserves the weighted average information of conflict evidence through the confidence factor λ generated by mapping. Therefore, even in high-conflict scenarios where current is abnormal but line loss is normal, this invention can still output reliable fusion results, significantly reducing the false alarm rate and improving the accuracy of electricity theft detection.

[0019] (ii) Achieving unified representation and fusion of multi-source data with extremely low data preprocessing and storage overhead. The basic probability assignment triplet maintained in this invention Only three probability values ​​are required, and the corrected storage requires only three floating-point or fixed-point numbers. In the two-layer credibility assessment, both the lower and upper layer credibility are obtained through lightweight statistical calculations based on existing load data, line loss data, and meter event data, without the need for additional complex feature engineering or large-capacity storage. Taking support for 200 users in a single distribution area as an example, the evidence storage overhead for each user per time period is less than 1KB, while the fusion calculation involves only three multiplications and one operation of the improved synthesis formula, making hardware implementation simple. Therefore, this invention achieves unified joint discrimination of multi-source heterogeneous data with extremely low data and computational overhead.

[0020] (iii) Without increasing the critical delay for real-time discrimination while ensuring the interpretability of the algorithm. In this invention, all features involved in the calculation (missing rate, coefficient of variation, three-phase imbalance, time difference, and historical hit rate) have clear physical meanings and engineering traceability, avoiding the problem of black-box models such as neural networks being difficult to interpret. Furthermore, an improved synthesis rule is used when K > 0.8, and this calculation process, along with data preprocessing and evidence construction steps, can be completely streamlined. In addition, upper-layer credibility is statistically analyzed using a sliding window (30 days), enabling the model to adaptively track changes in data quality across different transformer areas without requiring offline retraining. Therefore, this invention achieves high-precision, low-latency, interpretable, and self-evolving online anti-electricity theft detection. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating a method for detecting electricity theft using combined multi-source data, provided in an embodiment of the present invention; Figure 2 This is a spatial relationship diagram between users in a transformer substation, provided as an embodiment of the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] As one possible embodiment of the present invention, such as Figure 1 As shown, a method for detecting electricity theft using joint multi-source data is provided, including the following: S100: Collect and preprocess several types of evidence source data.

[0025] The evidence source data includes at least user load time-series data, transformer area line loss data, and meter event data. Specifically, the collected evidence source data is subdivided by source as follows: Load time-series data is collected from the electricity information collection system: including the instantaneous values ​​of three-phase voltage, three-phase current, active power, and reactive power for each user, with a sampling interval of 15 minutes; simultaneously, the status words of user meters (including undervoltage and undercurrent flags) are collected. Transformer area line loss data is collected from the line loss management system: including the three-phase voltage, three-phase current, and total active power of the transformer area's main meter, with a sampling interval of 15 minutes; simultaneously, the daily and hourly line loss rates of the transformer area are collected. Meter event data is collected from the metering automation system: including event records for each user's meter, including but not limited to cover opening events (including occurrence and end times), undervoltage events (including occurrence and duration), undercurrent events, and neutral / live wire current inconsistency events; as well as meter clock synchronization status and meter communication status.

[0026] One embodiment of this application is as follows: step S100 further includes collecting climate data and user information.

[0027] Climate data is collected from external environmental data sources, including weather data for the location of the transformer substation. This weather data includes lightning monitoring records (time and intensity), temperature, and humidity, used for subsequent calculations of technical weather correction factors. User information is collected from the marketing business system, including user profile information (contract capacity, electricity type, phase, branch box number), used for subsequent spatial correlation diagram construction and capacity normalization.

[0028] Preprocessing includes data cleaning, missing value imputation, outlier removal, and time-series alignment between different data sources. Data cleaning removes outliers that are clearly outside the reasonable range (such as negative power or current exceeding the range). Missing value imputation uses linear interpolation or forward imputation methods to handle consecutive missing values ​​exceeding a certain threshold. Users whose data quality is unreliable are marked as such, affecting subsequent credibility calculations. Outlier removal is based on the Raida criterion (…). (Principle) Identify and remove outliers. Time alignment unifies data with different sampling frequencies onto the same time axis, for example, by resampling all data at 15-minute intervals to ensure that data sources are comparable at the same time.

[0029] The reason for this step is that the original multi-source data has problems such as inconsistent formats, inconsistent timestamps, missing data, and noise. Without preprocessing, subsequent evidence construction and fusion will produce erroneous results. By cleaning, imputing, and aligning, a clean and synchronized data foundation can be provided for subsequent steps, thereby ensuring the accuracy and robustness of anti-electricity theft detection.

[0030] S200: Based on the preprocessed evidence source data of each user, determine the initial probability of each evidence source data belonging to the electricity theft proposition A at the current time for that user. , where i represents the type number of the evidence source data, and A represents the proposition of electricity theft.

[0031] For each user, the initial probability of electricity theft at the current moment is determined based on the corresponding load time-series data, transformer area line loss data, and meter event data. To generate initial probability assignment triples ( The initial probability of electricity theft is determined based on load time-series data. .

[0032] The specific method for determining this is as follows: obtain the user's load time-series data for the same period over the past 30 days, use time series decomposition methods (such as STL decomposition) to predict the expected electricity consumption at the current moment, and calculate the deviation rate between the actual electricity consumption and the expected value. Detecting load abrupt changes: Calculate the difference between the current sampling point and the previous several sampling points in the load time series data. If the difference exceeds three times the standard deviation of the historical difference mean and continues for more than two sampling points, the current sampling point is marked as a sudden change point.

[0033] The initial probability of electricity theft is determined by comprehensively mapping the deviation rate and the degree of mutation at the mutation point. For example: if the deviation rate is lower than Furthermore, there is a sudden drop, and the first initial probability of electricity theft obtained by mapping is... The corresponding calculated uncertain probability of electricity theft If the deviation rate is normal and there are no sudden changes, the first initial probability of electricity theft obtained by mapping is... The corresponding calculated uncertain probability of electricity theft .

[0034] The initial probability of electricity theft is generated based on longitudinal data anomalies in load time-series data. This reflects deviations in a user's electricity consumption behavior over time. Electricity theft typically manifests as an abnormal decrease in electricity consumption, inconsistent with historical patterns or patterns. By detecting electricity consumption prediction deviations and load surges, abnormal decreases that are difficult to explain by seasonality, holidays, or weather changes can be identified, thus forming evidence of suspected electricity theft.

[0035] Determine the second initial probability of electricity theft based on transformer area line loss data. .

[0036] The specific method for determining this is as follows: Calculate the Pearson correlation coefficient between the load curve of users within the transformer area and the line loss rate curve of the transformer area over the past 24 hours. If user load decreases while line loss increases, then If the value is negative and the absolute value is large, it is based on the correlation coefficient. With the second initial probability of electricity theft The mapping relationship determines the corresponding initial probability of electricity theft. For example: when When this is determined to be a strong correlation anomaly, the second initial probability of electricity theft is... The corresponding calculated uncertain probability of electricity theft ;when When the condition is determined to be unrelated, the second initial probability of electricity theft is... The corresponding calculated uncertain probability of electricity theft .

[0037] The second initial probability of electricity theft is determined based on the anomaly in the correlation between transformer area line loss data and actual user load. The Pearson correlation coefficient reflects the relationship between changes in user load and the overall power balance of the distribution area. Under normal circumstances, a decrease in user load will lead to a corresponding change in the line loss rate of the distribution area (usually in a negative correlation). If the user load decreases but the line loss rate does not change significantly, it indicates that there may be electricity theft behavior such as bypassing metering or shielding line loss characteristics. The Pearson correlation coefficient can quantify the degree of abnormality of this correlation.

[0038] Determining the third initial probability of electricity theft based on meter event data. .

[0039] The specific determination method is as follows: check whether any meter events occurred within the 24 hours prior to the current moment, and determine the corresponding third initial probability of electricity theft based on whether each meter event occurred. For example: if there are no events, then The corresponding calculated uncertain probability of electricity theft If an opening incident or a flow loss incident occurs, then The corresponding calculated uncertain probability of electricity theft If only a pressure loss event exists and its duration is less than [a certain value], then [the event is likely related to the previous statement]. minutes, then The corresponding calculated uncertain probability of electricity theft When multiple events occur simultaneously, the maximum value is taken.

[0040] Meter event data directly reflects changes in the physical state of a user's metering device. Opening the cover may indicate meter tampering; voltage loss may indicate a short circuit or current shunting in the voltage circuit; inconsistent live and neutral wire currents indicate that the live wire current has not been fully measured. These events are highly suggestive of electricity theft, especially when correlated with sudden load changes.

[0041] The three sources of evidence characterize suspected electricity theft from three independent dimensions: the user's own electricity consumption patterns, the overall power balance of the transformer area, and the physical condition of the metering device. Each dimension provides probabilistic evidence, serving as input for subsequent evidence fusion. This multi-dimensional design allows for supplementary evidence from other dimensions when one dimension is insufficient, improving the comprehensiveness of the judgment.

[0042] S300: Initial probability of electricity theft for each user The underlying credibility is determined based on the internal data characteristics of the corresponding evidence source data. The corresponding upper-level credibility is determined based on the historical hit rate of the evidence source data. Underlying credibility and upper-level credibility The initial probability of electricity theft corresponding to the weight synchronization correction. To generate the base probability of electricity theft .

[0043] Basic probability of electricity theft The formula is: , in, The underlying credibility is obtained based on the real-time data quality and physical environment indicators upon which each source of evidence relies; The credibility of the upper layer is obtained based on the historical accuracy rate of each evidence source as calculated by the sliding window.

[0044] The first underlying reliability of load time series data The acquisition method is as follows: S301a: Acquire user load data for the consecutive 24 hours (second preset time period) prior to the current time, and determine the data missing rate within this 24-hour period based on the load sampling frequency. The data missing rate is calculated as: number of missing points / total theoretical number of sampling points (if the sampling interval is 15 minutes, then there are 96 points in 24 hours). S302a: Obtain user load power values ​​sampled at fixed time intervals within the first preset time period before the current time (e.g., the past 7 days) to form a user load sequence, and obtain the coefficient of variation of the user load sequence. .in, The standard deviation of the user load sequence is given. This is the mean of the user's load sequence. S303a: According to and generate First level of credibility The calculation formula is: , in, The default missing penalty coefficient (e.g., 0.5). This is a preset attenuation factor (e.g., 0.3). The preset normal fluctuation range value for the coefficient of variation (e.g., 0.8). Set a pre-defined fluctuation saturation threshold for the coefficient of variation (e.g., 1.5).

[0045] The first term of the formula Used to penalize missing data. When the missing rate is below... When the penalty term increases linearly, it exceeds [a certain threshold]. At that time, the penalty item value is the largest. The penalty item makes Maximum reduction The physical meaning is that when load data is severely lacking, the judgment of longitudinal anomalies is unreliable, and the reliability of this source of evidence should be reduced. (Second item) Used to penalize drastic fluctuations in the load sequence. When the coefficient of variation... Exceeding the normal fluctuation threshold This indicates that the user's electricity consumption behavior is extremely unstable. Even if a load decrease occurs at this time, it may be a normal fluctuation rather than electricity theft, thus reducing credibility. Exceed At that time, the penalty term saturates. Through the two penalties mentioned above, the first level of credibility is... It can dynamically adjust based on data quality and user power consumption stability, avoiding misjudgments when data quality is poor or user behavior is highly volatile.

[0046] The second underlying reliability of transformer area line loss data The acquisition method is as follows: S301b: Obtain the average three-phase current within the third preset time period before the current time from the metering data of the transformer area's main meter. The system also includes climate information on whether lightning was recorded within a fourth preset time period, which includes the third preset time period. Specifically, the third preset time period is the past 15 minutes, and the average three-phase current over those 15 minutes is used to eliminate the impact of instantaneous fluctuations and reflect the steady-state load of the transformer area. The fourth preset time period is the past... Within an hour, climate information can be obtained from meteorological monitoring systems or local lightning location systems. S302b: Based on imbalance Determine the credibility correction factor Climate information determines climate correction factors First level of credibility The calculation formula is: , in, , This represents the reliability correction factor derived from the three-phase current imbalance, and its value decreases as the three-phase current imbalance increases. Its physical meaning is: when the ratio of the maximum phase current to the minimum phase current exceeds 1.5 times (i.e., ... When the three phases of the transformer substation are severely unbalanced, the total power measured by the main meter may have a large error due to transformer saturation or wiring problems, leading to distorted line loss rate data. Therefore, [the following text is incomplete and requires further context: "…"] Reduced to 0. When the ratio is between 1 and 1.5, Linearly decreasing. This is a weather correction factor; if there was a lightning record in the past hour, it is set to 0.7, otherwise it is set to 1. During lightning weather, the power grid may experience instantaneous overvoltage and inrush current, leading to abnormal meter readings or short-term fluctuations in line loss, thus reducing the reliability of the evidence source for line loss.

[0047] This step calculates the second-level reliability by introducing three-phase imbalance and weather factors. It can adaptively reduce the evidence weight when line loss data is unreliable, avoiding false alarms caused by measurement errors or weather interference.

[0048] The third underlying credibility of meter event data The acquisition methods are as follows: S301c: Obtain the set of meter event occurrence times within the fifth preset time period (e.g., 24 hours) before the current time, and the set of load change times for users in the load time series data. S302c: Change detection uses the sliding window method: calculate the difference between each sampling point and the previous point's load. If the difference exceeds three times the standard deviation of the user's historical load change mean, it is marked as a change time. S303c: If both the set of meter event occurrence times and the set of load change times are not empty, calculate the minimum time difference between them. If any set is empty, then let Greater than the preset time difference threshold (For example, taking infinity), thus enabling subsequent... S304c: Simultaneously obtain the historical false alarm factor of this meter over the past 30 days (sixth preset time period). If the same meter has recorded more than three false alarms in the past 30 days (i.e., the on-site inspection confirms that the incidents are unrelated to electricity theft), then Otherwise S305c: According to and ,generate : , in, The preset time difference threshold is preferably 15 minutes. The smaller the time difference between the meter event (such as opening the cover) and the load change, the stronger the correlation between the event and abnormal electricity consumption behavior, and the higher the credibility of the evidence. When the time difference is less than... hour, Less than It is positive; when the time difference exceeds the threshold, this item is 1, plus... If the value exceeds 1, then Truncated to 0. Historical false alarm factor. Additional penalties are applied to credibility: if the meter has frequently reported false alarms recently (e.g., due to clock skew or environmental interference causing false event triggering), its credibility is reduced even if the time difference between the event and the sudden change is small. Through the above design, this invention can effectively distinguish between meter events truly caused by electricity theft and false events caused by equipment malfunction or interference, improving the reliability of the evidence source.

[0049] upper layer credibility The method of obtaining it is: Based on length The sliding window method calculates the historical success rate for each type of evidence source data over a day. Specifically, for each type of evidence source data, after each output of the judgment result (initial probability of electricity theft)... The results are compared with the on-site inspection results. If the judgment is correct (i.e., the probability that the evidence source output matches the inspection result is high), a correct judgment is recorded. The number of correct judgments in the window is recorded as follows. The total number of outputs within the window is recorded as follows: The formula for calculating the credibility of the upper layer is: , The addition of 0.5 and 1 represents the Laplace smoothing factor, preventing extreme values ​​(such as 0 or 1) when the sample size is small. When the evidence source has no abnormal output for 7 consecutive days (i.e., no high-probability discrimination is output), its upper-level credibility is reduced to 0.9 times the original value to overcome the lag of historical statistics and enable the system to adapt to the long-term changing trend of data quality in the distribution area.

[0050] This step utilizes underlying credibility. and upper-level credibility The dual correction can dynamically adapt to the instantaneous fluctuations in data quality (such as data missing or lightning interference) and long-term statistical characteristics (such as the historical performance of each evidence source in different substations) of different evidence sources. Compared with the fixed-weight fusion method, the credibility correction mechanism significantly improves the adaptability and robustness of the fusion results.

[0051] S400: Based on basic electricity theft probability Determine the global conflict coefficient representing the differences between data from different evidence sources. Based on the revised Global conflict coefficient Jointly determine the initial probability of user electricity theft .

[0052] First, calculate the global conflict coefficient. According to the DS evidence theory, the conflict coefficient is defined as the sum of the products of the basic probability distributions of contradictory propositions among the sources of evidence. In this invention, since there are only two propositions (electricity theft proposition A and the uncertain proposition...), ,and Therefore, the set of propositions contains only and And A and Since they are disjoint, the conflict mainly arises from different sources of evidence supporting A and B respectively. The combination of these factors, therefore the global conflict coefficient The formula is: , when At that time, it was determined that the evidence was highly conflicting.

[0053] Initial user electricity theft probability The formula is: , Where n represents the number of types of evidence source data. express That is, the product of the three corrected probabilities of electricity theft; express That is, the product of three "uncertain" probabilities.

[0054] in, Based on the conflict coefficient The confidence factor obtained from the mapping, and One embodiment of this application is: the mapping function is That is, the conflict coefficient from arrive Linear mapping to arrive .when At that time, you can take it directly. Use the first term of the above formula (i.e., only use the product term, which is regarded as the traditional Dempster rule) to make joint judgments on the data.

[0055] The first term in the calculation formula This is a simplified form of the traditional Dempster rule, considering only two propositions. It assumes that the evidence is independent and obtains the fusion probability through product normalization. However, in cases of high conflict, this formula can lead to paradoxes (e.g., the fusion of two pieces of evidence supporting opposing propositions still yields a counterintuitive result). The second term... It is the arithmetic mean of the support for the proposition of electricity theft from each source of evidence. It preserves the independent opinions of each source of evidence and is unaffected by conflicts. (This is achieved through confidence factors.) Weighting the two together, when the degree of conflict is low ( (close to 0.8) The size is relatively small, and the fusion result is mainly due to The first term in the calculation formula determines whether the advantages of the DS theory are retained; when the degree of conflict is extremely high ( Approaching 1), When the result is close to 1, the fusion result tends towards the arithmetic mean, avoiding the paradox. This is based on the confidence factor. The weighted fusion strategy ensures high discriminative power in low-conflict situations and resolves the paradox in high-conflict situations, enabling the anti-electricity theft judgment to output reasonable and stable probability values ​​even when opinions from multiple sources of evidence conflict.

[0056] S500: Based on the initial user electricity theft probability Generate electricity theft alarm information.

[0057] when If the alarm level exceeds a preset primary alarm threshold (e.g., 0.6), a preliminary suspect record for the user is generated. However, to improve the accuracy of the judgment, A spatial correlation verification mechanism is further introduced to correct the initial probability and improve the accuracy of electricity theft alarm information generation.

[0058] As another possible embodiment of the present invention, the spatial association verification mechanism includes: S501: For each user within the distribution area, obtain the corresponding space adjustment factor for that user. .in, Indicates the user ID within the station area. M represents the total number of users within the designated area. Spatial adjustment factor. It can be obtained independently or in combination from the following two aspects.

[0059] On the one hand, isolated anomaly detection based on spatial residuals; The methods for obtaining it are as follows: S511a: Acquire the load power time-series data and user voltage time-series data for each user within the distribution area. This data has already been collected and preprocessed in S100. S521a: Based on the user voltage time-series data, construct a spatial correlation diagram between users within the distribution area.

[0060] In this method, nodes represent users, and edges are determined based on the Pearson correlation coefficient of user voltage sequences: if two users are in phase and their voltage correlation coefficient is higher than 0.9, then an edge exists between them. Voltage correlation is an effective proxy for electrical distance: users with closer electrical distances have more synchronized voltage fluctuations and stronger correlations. When branch information is incomplete, this method can automatically infer topological relationships through voltage correlation. If the branch box topology is known, edges are defined directly using topological membership relationships.

[0061] like Figure 2 As shown, nodes: each node represents a user within the transformer area, and sub-graphs of different colors or shapes distinguish the different power supply phases (phase A, phase B, phase C) to which the user belongs.

[0062] Edge: A solid line connecting two nodes indicates that the two users are not only in the same phase, but also have a Pearson correlation coefficient of voltage time series data that is higher than 0.9, indicating that their voltage fluctuation patterns are highly similar.

[0063] Connection mode: Users connected on the same power supply branch (same phase) have high correlation in voltage curves due to their short electrical distance and being affected by the same upstream node voltage. Therefore, they will form closely connected sub-graphs or clusters in the diagram (such as three users in phase A).

[0064] No connection: Users belonging to different phases (such as users in phase A and phase B) are powered by different transformer windings, and their correlation is naturally low. Therefore, no connection is established in the diagram (dashed lines are used in the diagram for illustration, but no actual connection exists). This helps to distinguish user groups of different phases from the topology.

[0065] S531a: According to user At the present moment Current load power and its neighboring user set The current load power of each neighboring user is calculated. Spatial residual at the current moment : , in, Indicates user The median of the load power of all neighboring users at the current moment. The median is used instead of the mean to avoid interference from extreme values ​​among neighbors (such as other users stealing electricity) in the estimation of normal levels.

[0066] k represents the ID of each neighbor user in the set N(j) of neighbor users of user j, i.e., k∈N(j). The value of k is a positive integer greater than or equal to 1 and less than or equal to the total number of users M in the area, but it is only included in the median calculation when k belongs to N(j).

[0067] Spatial residual It reflects the degree of deviation of user j's load at the current moment from the median load of its spatial neighbors (users in the same phase or with similar electrical distance).

[0068] when When the value is negative and the absolute value is large, it indicates that the load of user j is significantly lower than the typical level of its neighboring users. This violates the empirical rule that users in the same transformer area and phase should have roughly the same load level under normal power consumption conditions (after considering capacity difference normalization).

[0069] In electricity theft scenarios, users reduce the current flowing through the electricity meter by bypassing it or diverting current, resulting in an abnormally low metered load. Meanwhile, neighboring users, due to normal electricity consumption or lack of involvement in theft, maintain normal metered loads, creating a significant negative spatial residual. Therefore, the spatial residual can serve as an effective spatial feature to distinguish isolated electricity theft users from normal users or regional metering problems. If a user has a high probability of being suspected and the spatial residual is significantly negative, it further supports the conclusion of electricity theft. If neighbors are also suspected in similar ways, the spatial residual may approach zero, indicating a possible branch-line overall metering fault or group electricity theft, requiring further investigation using other methods. S541a: Obtaining User Information And the initial probability of electricity theft for all of the user's neighboring users. (From S400). S551a: If user The initial user electricity theft probability is higher than the first threshold (e.g., 0.6), and the spatial residual It is negative and its absolute value is greater than the second threshold (e.g., greater than the normal load). If, at the same time, the initial user electricity theft probability of all its neighboring users is lower than the third threshold (e.g., lower than 0.3), then the spatial adjustment factor is set to a value of [value missing]. (First adjustment value), otherwise take (Third adjustment value).

[0070] This method is applicable to identifying "isolated electricity theft" scenarios. This scenario is characterized by: a single user having a high initial probability of electricity theft, but a negative spatial residual with a large absolute value (i.e., load significantly lower than the median of neighbors), while all of this user's neighbors have low initial probabilities of electricity theft. This characteristic implies that the user's electricity anomaly is isolated and not caused by a problem with the overall metering of the branch line, and since all neighbors are functioning normally, the suspicion of electricity theft is more prominent. Therefore, the spatial adjustment factor is set to 1.2 to increase its final probability. Conversely, if the user and multiple neighbors are all in a high-probability state but the spatial residual is close to zero, it may belong to a regional anomaly (such as a faulty overall metering of the branch box).

[0071] On the other hand, collaborative electricity theft detection based on load transition timing matching, The acquisition methods are as follows: S511b: Acquire the load power time-series data of each user within the distribution area and acquire the total load power time-series data of the distribution area. This data has already been collected and preprocessed in S100. S521b: For each user... First-order difference calculation from load power time series data To generate the user's difference sequence: , in, The preset differential time interval is typically one acquisition period (e.g., 15 minutes). First-order differential can highlight transient load changes and eliminate the influence of long-term trends. S531b: Based on the standard deviation of the user's differential sequence. Extract each user Set of negative jump moments and the set of positive transition moments : , Using twice the standard deviation as a threshold can filter out normal random fluctuations and retain significant jumps.

[0072] The negative transition time set records the moments when user j's load power drops significantly within a short period of time. This drop is usually not caused by normal power consumption fluctuations (because the threshold is set to 2 standard deviations, which is much higher than the normal fluctuation range). In electricity theft scenarios, a negative transition may correspond to the following behaviors: the user begins to steal electricity (such as activating a shunt device or bypassing the meter), reduces the intensity of electricity theft, or switches from the operating state of a high-power appliance to the standby state.

[0073] If the negative jump coincides closely with the timing of meter events (such as opening the cover or loss of current), it further strengthens the suspicion of electricity theft.

[0074] In collaborative electricity theft detection, negative transition is the starting point of the "one rises, the other falls" pattern: a decrease in the load on one side suggests that it may be "exiting" the electricity theft state or transferring the load.

[0075] The set of positive transition moments records the times when user j's load power increases significantly within a short period of time. In the context of electricity theft, a positive transition may correspond to the following behaviors: the user stops stealing electricity (e.g., disconnecting the shunt device), resumes full load power consumption, or receives load transferred from other users.

[0076] In collaborative electricity theft detection, a positive transition is the end of a "one-up, one-down" pattern: the load on the other side increases, suggesting that it may be "taking over" electricity theft or assuming the transferred load.

[0077] When the negative and positive load transitions of a pair of users are closely coupled in time (the time difference is less than a preset window), and the total load of the distribution area remains stable, it indicates a suspicion of load transfer from one user to the other. This is a typical characteristic of alternating electricity theft or coordinated crimes. This is because: in normal electricity consumption, a significant increase in load (such as starting a high-power air conditioner or motor) usually does not occur simultaneously with a significant decrease in load from another user; therefore, this time coupling phenomenon is highly indicative of electricity theft.

[0078] S541b: For any two different users within the same area and If it exists and , making Less than or equal to the preset time window length (e.g., 30 minutes), and within the time interval Within the overlapping interval of positive and negative transition times, the rate of change of the total load power of the transformer area is lower than the fourth threshold (e.g., ), then determine the user's opinion on ( (This is in connection with the suspected electricity theft.)

[0079] The rate of change of the total load power of the transformer area is defined as: over the time interval Inside, If the absolute rate of change is lower than the fourth threshold (e.g.) If the total load of the distribution area is stable, then it is considered that the total load of the distribution area is stable.

[0080] The core of this detection logic is to identify alternating patterns of electricity theft: when one user's load suddenly drops (potentially initiating electricity theft), another user's load suddenly increases (potentially resuming power or shifting load), while the total load of the distribution area remains stable, indicating that load shifting is occurring to conceal electricity theft. S551b: If a user... Users who are suspected of colluding in electricity theft, (Second adjustment value), otherwise .

[0081] This method is applicable to identifying "coordinated electricity theft" scenarios, particularly "alternating electricity theft." This scenario is characterized by two users: one user's load experiences a significant negative jump at a certain moment (potentially initiating or reducing the intensity of electricity theft), while the other user's load experiences a significant positive jump around the same moment (potentially restoring power or shifting load), while the total load of the distribution area remains stable. This "ebb and flow" pattern is difficult to explain with normal electricity consumption behavior, highly suggesting organized alternating electricity theft between users to mask abnormal line losses. Once a suspected coordinated electricity theft pair is detected, it indicates a high probability of group-based coordinated electricity theft, and the suspicion probability of the two users should be significantly increased (adjustment factor 1.5) to attract the attention of auditing authorities.

[0082] The two aspects mentioned above are used together to obtain the spatial adjustment factor. The process is as follows: Obtaining users Neighboring users, users Spatial residual of electricity consumption differences with neighboring users Determine whether it simultaneously meets the user's requirements. The initial probability of electricity theft is higher than the first threshold, and the spatial residual If the second threshold is exceeded and the initial probability of electricity theft by neighboring users is lower than the third threshold, then it is a spatial adjustment factor. If the first adjustment value is 1.2, then check if the user's settings also meet the criteria. If the positive and negative transition time difference of the load power of any user within the transformer area is lower than the corresponding time difference threshold, and the rate of change of the total load power of the transformer area within the overlapping interval of positive and negative transition times is lower than the fourth threshold, then it is a spatial adjustment factor. For the second adjustment value (e.g., 1.5), or spatial adjustment factor. The third adjustment value (e.g., 1).

[0083] S502: Utilizing spatial adjustment factors Initial probability of electricity theft for this user Adjustments were made to calculate the end-user electricity theft probability for this user. : , S503: Compare the final probability of electricity theft with a preset alarm threshold (e.g., 0.7). When the threshold value exceeds the alarm threshold, an electricity theft alarm is generated for that user, and a list of suspected users and a list of suspected colluding electricity theft partners are output. If the power consumption is below the alarm threshold, no alarm information for that user will be generated.

[0084] Step S500 verifies the electricity consumption correlation between users to determine the initial probability of electricity theft for each individual user. By performing secondary corrections, this serial correction structure, which prioritizes individual judgment and supplements spatial verification, significantly improves the reliability and interpretability of the final judgment.

[0085] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0086] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0087] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0088] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0089] An electronic device according to this embodiment of the invention. The electronic device is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the invention.

[0090] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0091] The memory stores program code that can be executed by a processor, causing the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.

[0092] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0093] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0094] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0095] The electronic device can also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication can be performed via input / output (I / O) interfaces. Furthermore, the electronic device can communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. The network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0096] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the present invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the present invention described in the "Exemplary Methods" section above.

[0097] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0098] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0099] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0100] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0101] Furthermore, the accompanying drawings are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention and are not intended to be limiting. It is readily understood that the processes shown in the above drawings do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0102] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0103] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting electricity theft using combined multi-source data, characterized in that, Includes the following: To obtain the initial probability of electricity theft, the corresponding initial probability of electricity theft is determined based on several types of evidence source data from the user. , where i represents the type number of the evidence source data, and A represents the proposition of electricity theft; Generate a basic probability of electricity theft and determine the corresponding underlying credibility based on the internal data characteristics of various evidence sources. The corresponding upper-level credibility is determined based on the historical hit rate of various evidence source data. Underlying credibility and upper-level credibility The initial probability of electricity theft corresponding to the weight synchronization correction. To generate the base probability of electricity theft ; Determine the initial user electricity theft probability based on the baseline electricity theft probability. Determine the global conflict coefficient representing the differences between data from different evidence sources. Initial user electricity theft probability The calculation formula is: ， in, Based on global conflict coefficient The confidence factor obtained by mapping, where n represents the number of types of evidence source data; The evidence source data includes user load time-series data, and the first underlying credibility corresponding to the load time-series data is determined. This includes: obtaining the user load sequence within a first preset time period from the load time series data, and determining the standard deviation of the load sequence. and mean The ratio determines the actual coefficient of variation. The data missing rate is determined based on the corresponding load sequence and load sampling frequency within the second preset time period in the load time series data. First level of credibility The calculation formula is: ， in, The default penalty coefficient is the missing value. The preset attenuation factor, The normal fluctuation threshold preset for the coefficient of variation. The preset fluctuation saturation threshold for the coefficient of variation.

2. The method according to claim 1, characterized in that, The evidence source data includes user's transformer area line loss data and meter event data.

3. The method according to claim 2, characterized in that, Determine the second underlying reliability corresponding to the line loss data of the transformer area. This includes: obtaining the average three-phase current within the third preset time period from the transformer area line loss data. And climate information within a fourth preset time period, including the third preset time period, based on imbalance Determine the credibility correction factor Determining climate correction factors based on climate information Second underlying credibility The calculation formula is: 。 4. The method according to claim 3, characterized in that, The credibility correction factor The calculation formula is: 。 5. The method according to claim 2, characterized in that, Determine the third underlying credibility corresponding to the meter event data. This includes: obtaining the set of event occurrence times from meter event data within the fifth preset time period, and the set of user load change times from load time series data, and calculating the minimum time difference between the set of event occurrence times and the set of load change times. ; Obtain the number of false alarms within the sixth preset time period from the meter event data to determine the historical false alarm factor. Third underlying credibility The calculation formula is: ， in, This is a preset time difference threshold.

6. The method according to claim 1, characterized in that, global conflict coefficient The calculation formula is: ， in, .

7. The method according to claim 2, characterized in that, User-based space adjustment factor Adjusting the initial user electricity theft probability To generate the probability of end-user electricity theft Compare the probability of electricity theft by end users Whether to generate a user's electricity theft alarm information is determined by the preset alarm threshold.

8. The method according to claim 7, characterized in that, Determine the spatial adjustment factor Includes: acquiring users Neighboring users, users Spatial residual of electricity consumption differences with neighboring users Determine whether it simultaneously meets the user's requirements. The initial user's probability of electricity theft is higher than the first threshold, and the spatial residual... If the second threshold is exceeded and the initial probability of electricity theft by neighboring users is lower than the third threshold, then it is a spatial adjustment factor. This is the first adjustment value; No, determine whether it simultaneously meets the user's requirements. If the positive and negative transition time difference of the load power of any user within the transformer area is lower than the corresponding time difference threshold, and the rate of change of the total load power of the transformer area within the overlapping interval of positive and negative transition times is lower than the fourth threshold, then it is a spatial adjustment factor. This is the second adjustment value; otherwise, it is a spatial adjustment factor. This is the third adjustment value.

9. The method according to claim 8, characterized in that, Determine the spatial residual This includes: acquiring voltage time-series data of each user in the load time-series data to calculate the correlation coefficient between each user, and constructing a spatial correlation graph between users with users as nodes and whether the correlation coefficient exceeds the correlation threshold as the association condition; User identification based on spatial association graph Neighboring users, users Its spatial residual The calculation formula is: ， in, Indicates user The current load power at the current moment, Indicates user The set of neighboring users, Indicates user The median load power of all neighboring users at the current moment.

Images