False transaction data intelligent identification method fusing electrical behavior pattern and physical constraints

Abstract

This invention relates to the field of power transaction data identification technology, and particularly to an intelligent identification method for fraudulent transaction data that integrates electricity consumption behavior graphs and physical constraints. The method acquires multi-source power data and operational measurement data, preprocesses them to obtain standard data, and performs multi-timescale entity alignment and topological association on the standard data to construct a cross-domain dataset with a unified spatiotemporal benchmark. Based on this cross-domain dataset, a heterogeneous time-series behavior graph of power, containing various node and edge types, is constructed. According to the differences in data update frequency, the heterogeneous time-series behavior graph is divided into slow-changing and fast-changing layers. This invention eliminates the entity alignment barrier across systems, solves the defects of traditional anomaly detection schemes caused by semantic confusion of relationships and feature aggregation collapse leading to reduced identification sensitivity, improves the penetration fusion and association modeling capabilities of heterogeneous cross-system data, and reduces the false transaction false detection rate caused by the siloed nature of multi-source information.

Description

Technical Field

[0001] This invention relates to the field of electricity transaction data identification technology, and in particular to an intelligent identification method for fraudulent transaction data that integrates electricity consumption behavior patterns and physical constraints. Background Technology

[0002] Currently, a single electricity transaction settlement typically involves data such as the transaction entity, user profile, contract capacity, declared electricity volume, smart meter metering curves, distribution network topology, transformer area or feeder relationships, and deviation assessment rules. These data come from different systems and lack an organic physical and semantic alignment mechanism, resulting in a significant information silo effect. This greatly reduces the cross-system data interaction and penetration capabilities, thus providing a concealed space for carefully designed fraudulent transactions. Consequently, fraudulent electricity transactions exhibit advanced cross-domain collaborative camouflage and physical concealment.

[0003] However, existing methods for detecting abnormal electricity market data mostly rely on user historical electricity consumption curves, peak-valley characteristics, load fluctuations, and holiday patterns to identify these hidden and complex fraudulent electricity transaction data. The problem is that these methods mainly model individual users or individual metering points, making it difficult to express the various relationships between transaction entities, contracts, users, metering devices, and feeder topologies. This can easily lead to a fragmented global defense perspective and affect the system-level detection rate of abnormal behavior. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides an intelligent identification method for fraudulent transaction data that integrates electricity consumption behavior graphs and physical constraints. This method solves the problems in existing technologies, such as low detection rate of collaborative anomalies, difficulty in intercepting residual-preserving concealed tampering, and the impact on judgment accuracy due to lack of semantic distinguishability and strong mechanistic constraints.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a method for intelligent identification of fraudulent transaction data that integrates electricity consumption behavior patterns and physical constraints, comprising the following steps: Acquire multi-source power data and operational measurement data and preprocess them to obtain standard data. Perform entity alignment and topological association on the standard data at multiple time scales to construct a cross-domain dataset with a unified spatiotemporal benchmark. Based on cross-domain datasets, a heterogeneous time-series behavior graph of the power industry is constructed, which includes multiple node types and multiple edge types. According to the difference in data update frequency, the heterogeneous time-series behavior graph of the power industry is divided into a slow-changing layer for maintaining relatively stable entity relationships and a fast-changing layer for maintaining high-frequency trading and metering behavior. In the heterogeneous time-series behavior graph of the power industry, a multi-dimensional cross-domain meta-path containing semantic constraints of power business is defined. The graph data containing fast-changing layers and slow-changing layers is input into a pre-trained relation-aware graph learning model. The cross-domain relation features are aggregated and represented along the multi-dimensional cross-domain meta-path through the attention mechanism, and graph-level risk scores, entity-level risk scores and estimated values ​​of credible node injection quantities with physical dimensions are generated for the target object. Based on the preset distribution network physical model and the estimated value of the injected quantity of trusted nodes, the power flow analysis of the distribution network system is carried out, the physical consistency residuals that characterize the deviation of the actual operating state of the power system are calculated, the preset power trading capacity and settlement compliance boundary are parameterized and mapped, and the business rule residuals that characterize the compliance deviation of power trading business are calculated. By integrating graph-level risk scores, entity-level risk scores, physical consistency residuals, and business rule residuals, the cross-domain consistency residual vector of the target object is calculated. When it meets the preset multi-dimensional anomaly joint judgment conditions, false transaction data is identified and located. Based on the reverse tracing of multi-dimensional cross-domain meta-paths, an audit evidence package containing abnormal time windows, abnormal spatial paths, physical residuals, and rule triggering items is generated.

[0006] Furthermore, the step of constructing a power heterogeneous time-series behavior graph containing multiple node types and multiple edge types specifically includes: Entity objects in the cross-domain dataset are extracted as the basic node types of the graph. The basic node types include at least the transaction entity nodes and user nodes representing market participants, the metering device nodes representing measurement terminals, the contract nodes representing compliance boundaries, and the feeder connection nodes representing the distribution network topology. The edge types of the graph are extracted based on the business interaction relationships and physical cable connection relationships between entity objects in the power system; The edge types include at least the following: transaction entity-user edge representing agency or settlement attribution attributes; user-metering device edge representing terminal data acquisition mapping attributes; transaction entity-contract edge representing market performance constraints; user-user edge representing historical load characteristic similarity or abnormal coordination attributes; and metering device-feeder topology edge representing power transmission path of distribution network.

[0007] Furthermore, the step of dividing the heterogeneous power time-series behavior map into slow-changing layers and fast-changing layers according to the difference in data update frequency specifically includes: Using a preset transaction settlement cycle or measurement data sampling window as the time base, dynamically update the node feature vectors and edge connection weights within the graph; The steady-state topology network, which includes the transaction entity-contract edge, the user-metering device edge, and the metering device-feeder topology edge, is defined as a slowly varying layer. The dynamic evolution network, which includes frequently updated transaction electricity reporting features, smart meter power measurement curves, and user-user edges, is defined as the fast-changing layer.

[0008] Furthermore, the step of defining a multi-dimensional cross-domain meta-path containing power business semantic constraints in the heterogeneous time-series behavior graph includes combining and concatenating multiple node types and multiple edge types to construct a semantic topological association sequence representing specific cross-domain business logic. The semantic topological association sequence includes at least: The transaction entity-user-metering device association sequence is used to align and characterize the longitudinal consistency between the total amount of macro transaction entity reporting behavior in the information domain and the sum of actual physical equipment energy consumption. The user-metering device-feeder association sequence is used to extract and verify the cross-domain association closure between the micro-user metering anomaly status and the physical bearing constraints of the actual distribution feeder. The transaction entity-user-user association sequence is used to laterally scan and characterize the collaborative camouflage of different micro-user groups belonging to the same agent transaction entity within a specific time window. The contract-user-metering-feeder association sequence is used to characterize the cross-domain rigid constraints that penetrate from the market contractual capacity parameters to the actual carrying capacity of the final distribution network physical transformers and lines.

[0009] Furthermore, during the training phase, the relationship-aware graph learning model employs a joint optimization objective function that integrates physical mechanism constraints and business rule red lines to perform gradient optimization of network parameters, and calculates the joint loss value using the joint optimization objective function. The calculation formula is as follows: In the above formula, Indicates the joint loss value; This represents the loss value for identifying fraudulent transactions, calculated based on historical sample labels. The physical consistency residual penalty loss value represents the cross-domain penetration, which forces the model feature space representation to be pulled into the power flow feasibility solution region that satisfies the Kirchhoff equations during iteration; This represents the residual penalty loss value of the business rules, used to ensure that the output of the hard constraint model does not exceed the red line of the market contract and transaction settlement capacity rules; This represents the regularization loss value used to smooth the network weights. These represent the dimension alignment and weight normalization coefficients of the penalty gradients assigned to each constraint, respectively.

[0010] Furthermore, the step of aggregating and representing cross-domain relationship features along a multi-dimensional cross-domain meta-path using an attention mechanism to generate a graph-level risk score, an entity-level risk score, and an estimate of the injection quantity of trusted nodes with physical dimensions for the target object specifically includes: For any target node in the graph, based on the differences in the types of its neighboring nodes, the differences in the types of connecting edges, and the temporal decay characteristics of the time window, a multi-head attention network is used to calculate the relationship-specific attention weight distribution on different business semantic edges. By utilizing relation-specific attention weight distribution to perform weighted fusion and projection transformation on the multidimensional heterogeneous features of its neighboring nodes, a shared hidden layer feature vector representing the consistency state of the target node in the global network topology is generated. The shared hidden layer feature vectors are synchronously fed into multiple parallel prediction network branches, where the classification network branch outputs an entity-level risk score for the target node and a global graph-level risk score in the current graph snapshot environment. The regression prediction network branch reconstructs the corresponding active and reactive power prediction values ​​based on the shared hidden layer feature vectors, which serve as the estimated values ​​of the reliable node injection quantity for subsequent physical equation verification.

[0011] Furthermore, the step of calculating the physical consistency residual characterizing the deviation of the actual operating state of the power system specifically includes: The estimated value of the injection of the reliable node is used as the observed proxy value of the actual injected power of the physical topology node of the distribution network. Combined with the pre-acquired distribution network feeder impedance parameters and branch connection relationship matrix, the power flow calculation equation is used to solve the inflow active power, inflow reactive power and line loss power of the distribution branch. Based on Kirchhoff's current law and voltage drop equation, the residuals of active power node balance deviation, reactive power node balance deviation, and node voltage over-limit residuals when the actual operating node voltage deviates from the safe threshold range are calculated for each physical topology node. By introducing a preset penalty weight coefficient matrix, linear or nonlinear weighted aggregation operations are performed on the residuals of active power node balance deviation, reactive power node balance deviation, node voltage over-limit residuals, and line branch capacity over-limit residuals to generate physical consistency residuals that characterize the feasibility of cross-domain closure of the power grid system in this region.

[0012] Furthermore, the step of calculating the cross-domain consistency closed residual vector of the target object and performing multi-dimensional anomaly joint determination specifically includes: By using a preset normalization function, the risk score, the physical consistency residual, and the business rule residual representing transaction declaration exceeding limits or contract binding mismatch are mapped to a unified dimension space, and spliced ​​together to generate a high-dimensional cross-domain consistency closed residual vector. Build a multi-level risk alert filtering engine: If the graph-level risk score or entity-level risk score exceeds the first baseline security threshold, but the cross-domain consistency closure residual vector does not show significant joint deviation between dimensions, the target object will be downgraded and marked as an observation-level candidate queue, and the strong audit procedure will be temporarily suspended. If the risk score exceeds the second highest security threshold, and the magnitude of the physical consistency residual or the frequency of business rule residual triggering in the cross-domain consistency closed residual vector exceeds the set joint review threshold, the corresponding subsequent anti-counterfeiting traceability verification will be automatically triggered.

[0013] Furthermore, the steps of identifying and locating fraudulent transaction data, and generating an audit evidence package based on reverse tracing of multi-dimensional cross-domain meta-paths, specifically include: Extract the offline topology version library and metering history stubs corresponding to the abnormal time window for forced offline power flow re-verification and anti-counterfeiting traceability verification; Based on the confirmation result of the forced offline flow re-verification, the transaction data was determined to be fraudulent, and relevant evidence fields were extracted based on business relationships and cryptographic mechanisms. The system generates business evidence fields that not only include abnormal time windows, suspicious users, and suspicious distribution branch location information, but also encapsulates the underlying input data digest hash value and network topology version identification information extracted based on an anti-tampering hash algorithm, ultimately generating a structured audit evidence package that can be manually reviewed and accepted by judicial supervision.

[0014] By employing the above technical solution, the present invention provides a method for intelligent identification of fraudulent transaction data that integrates electricity consumption behavior patterns and physical constraints, which has at least the following beneficial effects: 1. This invention constructs a heterogeneous time-series behavior graph of power systems containing multiple node and edge types, and scientifically divides it into slow-changing layers and fast-changing layers. Combined with the definition of multi-dimensional cross-domain meta-paths, it eliminates the entity alignment barrier across systems, solves the defects of traditional anomaly detection schemes caused by the confusion of relational semantics and feature aggregation collapse, which reduces the identification sensitivity. It improves the penetration fusion and correlation modeling capabilities of heterogeneous data across systems and reduces the false transaction false alarm rate caused by the characteristics of multi-source information islands.

[0015] 2. This invention utilizes a relation-aware graph learning model to reverse reconstruct and output reliable node injection quantity estimates with physical dimensions. Based on this, it imports the real network topology equations to solve the physical consistency residuals. Simultaneously, it combines the business rule residuals obtained from parameterized mapping, forcing high-order malicious tampering behavior into the dead end where the physical equations and business compliance red lines cannot be reconciled. This breaks the business silos that separate data and mechanisms, and reduces the substantial harm caused by covert metering tampering to the safe operation of the distribution network and the compliance of transaction settlement.

[0016] 3. This invention uses cross-domain consistent closed residual vectors to globally solve the deviation of the target object in the multi-dimensional heterogeneous space of time anomalies, relationship anomalies, physical consistency and business rules. This avoids the technical pain points of underreporting caused by overly rigid rules or uncertainty in pure model scores affecting decision confidence. It reduces the volatility and one-sidedness of anomaly judgment and prevents the waste of human resources and management costs in actual settlement audit and internal audit work caused by frequent false alarms. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart of the intelligent recognition method of the present invention; Figure 2 This is an overall flowchart of the intelligent recognition method of the present invention; Figure 3 This is a time-series behavior map of power heterogeneity in the intelligent identification method of the present invention; Figure 4 This is a diagram illustrating the structure of relation-aware graph learning and constraint joint training in the intelligent recognition method of this invention. Detailed Implementation

[0018] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. This will allow for a full understanding of how the present application uses technical means to solve technical problems and achieve technical effects, and to facilitate its implementation.

[0019] In the actual operation of the existing power market, the underlying data systems such as trading, marketing, metering, and distribution network automation are often built independently. This heterogeneous system barrier easily creates a severe information silo effect, affecting the penetration and verification capabilities of cross-system data. When faced with sophisticated, covert fraudulent transactions or physical residual-preserving data injection attacks launched by unscrupulous entities, format verification or conventional bad data detection algorithms within a single system often fail, resulting in high-frequency false alarms or serious missed alarms. This reduces the defense depth of power data auditing and may even cause substantial damage to the safe and stable operation of the distribution network. This invention mainly targets the following types of fraudulent or abnormal transaction data: 1. Direct business-related anomalies: Transaction declarations, contract capacity, user profiles, settlement fields, or transaction qualification fields have been tampered with, while the physical metering data itself shows no obvious anomalies; 2. Indirect physical anomalies: Measurement curves, node injection volumes, or operational measurement data are tampered with, and the tampering results can partially evade conventional bad data detection; 3. Collaborative composite anomalies: Transaction declaration fields and metering fields are adjusted simultaneously, forming a collaborative disguise among multiple users, contracts, or metering devices; 4. Relationship mismatch anomalies: Mismatches exist in user-metering device binding, contract-user binding, transaction entity-user relationship, or metering device-feeder topology relationship; 5. Rule-critical avoidance anomalies: The number of applications, deviations, or capacity utilization rates remain near the rule threshold for a long period of time. A single inspection does not show obvious exceedances, but an abnormal profit pattern is presented in the time series and graph relationship.

[0020] This embodiment proposes an intelligent identification method for fraudulent transaction data that integrates electricity consumption behavior maps and physical constraints. Figure 1 and Figure 2 As shown, the method includes the following steps: We acquire multi-source power data and operational measurement data and preprocess them to obtain standard data. We then perform multi-time-scale entity alignment and topological association on the standard data to construct a cross-domain dataset with a unified spatiotemporal benchmark.

[0021] Multi-source power data includes power transaction data, contract data, user profile data, and metering data. Power transaction data includes transaction entity number, declared electricity volume, declared power, transaction type, transaction price, settlement cycle, and deviation assessment results. Contract data includes contract number, contract entity, contract capacity, effective date, termination date, agency relationship, and settlement rules. User profile data includes user number, industry category, voltage level, electricity consumption category, historical electricity consumption level, and historical anomaly records. Metering data includes metering device number, sampling time, electricity consumption, active power, reactive power, voltage, current, missing data flags, and data quality flags. Distribution network topology data includes feeder number, transformer substation number, transformer capacity, line impedance, branch connection relationships, and topology version.

[0022] Operational measurement data includes node voltages, branch power flow, state estimation results, and topology change records.

[0023] Preprocessing includes unifying entity numbers; aligning settlement cycles and metering sampling times; filling in missing metering values ​​and retaining missing flags; windowing data at different time granularities; managing topology versions with timestamps; and marking obviously dirty data instead of deleting it directly.

[0024] like Figure 3 As shown, based on a cross-domain dataset, a heterogeneous time-series behavior graph of the power industry is constructed, which includes multiple node types and multiple edge types. According to the difference in data update frequency, the heterogeneous time-series behavior graph of the power industry is divided into a slow-changing layer for maintaining relatively stable entity relationships and a fast-changing layer for maintaining high-frequency trading and metering behavior.

[0025] The expression for the time-series behavior map of heterogeneous power systems is: In the above formula, It is a set of nodes, including transaction entity nodes, user nodes, metering device nodes, contract nodes, and physical topology nodes; For time window The set of edges inside; Features are node features and edge features; A set of edge types; This includes information such as time window, settlement cycle, or topology version.

[0026] In this embodiment, as a preferred implementation method, the implementation steps are as follows: Entity objects in the cross-domain dataset are extracted as the basic node types of the graph. The basic node types include at least the transaction entity nodes and user nodes representing market participants, the metering device nodes representing measurement terminals, the contract nodes representing compliance boundaries, and the feeder connection nodes representing the distribution network topology. The edge types of the graph are extracted based on the business interaction relationships and physical cable connection relationships between entity objects in the power system.

[0027] The edge types include at least the following: transaction entity-user edge representing agency or settlement attribution attributes; user-metering device edge representing terminal data acquisition mapping attributes; transaction entity-contract edge representing market performance constraints; user-user edge representing historical load characteristic similarity or abnormal coordination attributes; and metering device-feeder topology edge representing power transmission path of distribution network.

[0028] Using a preset transaction settlement cycle or measurement data sampling window as the time base, the node feature vectors and edge connection weights in the graph are dynamically updated; the steady-state topology network containing transaction subject-contract edge, user-metering device edge, and metering device-feeder topology edge is defined as a slow-changing layer; the dynamic evolution network containing frequently updated transaction electricity declaration features, smart meter metering power curves, and user-user edge is defined as a fast-changing layer.

[0029] like Figure 4 As shown, a multi-dimensional cross-domain meta-path containing power business semantic constraints is defined in the heterogeneous time-series behavior graph of the power industry. The graph data containing fast-changing layers and slow-changing layers is input into a pre-trained relation-aware graph learning model. The cross-domain relation features are aggregated and represented along the multi-dimensional cross-domain meta-path through an attention mechanism, generating graph-level risk scores, entity-level risk scores, and estimates of the amount of credible node injection with physical dimensions for the target object.

[0030] In this embodiment, as a preferred implementation method, the implementation steps are as follows: This includes combining and concatenating multiple node types and multiple edge types to construct a semantic topological association sequence representing specific cross-domain business logic. The semantic topological association sequence includes at least: The transaction entity-user-metering device association sequence is used to align and characterize the vertical consistency between the total amount of macro-level transaction entity's reported behavior in the information domain and the sum of actual physical equipment energy consumption; the user-metering device-feeder association sequence is used to extract and verify the cross-domain association closure between the micro-level user's metering anomaly status and the physical carrying capacity constraints of the actual distribution feeder; the transaction entity-user-user association sequence is used to horizontally scan and characterize the lateral behavior coordination and camouflage of different micro-level user groups belonging to the same agent transaction entity within a specific time window; the contract-user-metering device-feeder association sequence is used to characterize the cross-domain rigid constraints from the market contractual capacity parameters to the actual carrying capacity of the final distribution network physical transformer and line.

[0031] The relationship-aware graph learning model employs a joint optimization objective function that integrates physical mechanism constraints and business rule red lines during the training phase to optimize the gradient of network parameters, and calculates the joint loss value using the joint optimization objective function. The calculation formula is as follows: In the above formula, Indicates the joint loss value; This represents the loss value for identifying fraudulent transactions, calculated based on historical sample labels. The physical consistency residual penalty loss value represents the cross-domain penetration, which forces the model feature space representation to be pulled into the power flow feasibility solution region that satisfies the Kirchhoff equations during iteration; This represents the residual penalty loss value of the business rules, used to ensure that the output of the hard constraint model does not exceed the red line of the market contract and transaction settlement capacity rules; This represents the regularization loss value used to smooth the network weights. These represent the dimension alignment and weight normalization coefficients of the penalty gradients assigned to each constraint, respectively.

[0032] In a preferred embodiment, the relation-aware graph learning model assigns relation weights to different node types and different edge types. For the target node, the model calculates attention weights based on neighbor node types, edge types, time windows, and edge features, and then aggregates information from different relations.

[0033] For example, the transaction entity-user edge primarily reflects settlement attribution and agency relationships; the user-metering device edge primarily reflects actual metering binding; the user-user edge primarily reflects behavioral similarities or collaborative relationships; and the metering device-feeder edge primarily reflects physical topology. These edges should not be considered the same type of ordinary connection. The model distinguishes the semantics of different edges through relation-specific parameters or relation-specific attention weights.

[0034] The model can internally form a shared, consistent representation. This representation serves the following tasks simultaneously: 1. Output a risk score for fraudulent transactions; 2. Output suspicious entities or suspicious paths; 3. Output reliable measurement estimates or corrected node injection amounts; 4. Output the residual of the business rule or the probability of rule triggering; 5. Provide information on the materiality of the audit evidence package.

[0035] This design differs from post-processing workflows that first use a graphical model to generate anomaly scores and then perform separate physical or rule validations. In this invention, physical and rule residuals can participate in model training or joint inference, enabling the model to learn the common constraints between transaction relationships, physical feasibility, and business rules.

[0036] The steps for generating graph-level risk scores, entity-level risk scores, and estimates of the injection volume of trusted nodes with physical dimensions for the target object specifically include: For any target node in the graph, based on the differences in the types of its neighboring nodes, the differences in the types of connecting edges, and the temporal decay characteristics of the time window, a multi-head attention network is used to calculate the relationship-specific attention weight distribution on different business semantic edges.

[0037] By utilizing relation-specific attention weight distribution to perform weighted fusion and projection transformation on the multidimensional heterogeneous features of its neighboring nodes, a shared hidden layer feature vector representing the consistency state of the target node in the global network topology is generated.

[0038] The shared hidden layer feature vector is synchronously fed into multiple parallel prediction network branches. The classification network branch outputs an entity-level risk score for the target node and a global graph-level risk score in the current graph snapshot environment. The regression prediction network branch reconstructs the corresponding active and reactive power prediction values ​​based on the shared hidden layer feature vector, which are used as the estimated values ​​of the credible node injection amount for subsequent physical equation verification.

[0039] Traditional single-dimensional threshold exceeding limits easily leads to high-frequency false alarms, resulting in a serious waste of audit resources. This embodiment performs power flow analysis of the distribution network system based on a preset distribution network physical model and the estimated value of the injected quantity of trusted nodes, calculates the physical consistency residual that characterizes the deviation of the actual operating state of the power system, and parametrically maps the preset power trading capacity and settlement compliance boundary to calculate the business rule residual that characterizes the compliance deviation of power trading business.

[0040] The steps for calculating the physical consistency residual, which characterizes the deviation of the actual operating state of the power system, specifically include: The estimated value of the injected power at a reliable node is used as the observed proxy value of the actual injected power at the physical topology node of the distribution network. Combined with the pre-acquired distribution network feeder impedance parameters and branch connection matrix, the power flow calculation equation is used to solve for the inflow active power, inflow reactive power and line loss power of the distribution branch.

[0041] Based on Kirchhoff's current law and voltage drop equation, the residuals of active power node balance deviation, reactive power node balance deviation, and node voltage over-limit residuals when the actual operating node voltage deviates from the safe threshold range are calculated for each physical topology node.

[0042] By introducing a preset penalty weight coefficient matrix, linear or nonlinear weighted aggregation operations are performed on the residuals of active power node balance deviation, reactive power node balance deviation, node voltage over-limit residuals, and line branch capacity over-limit residuals to generate physical consistency residuals that characterize the feasibility of cross-domain closure of the power grid system in this region.

[0043] Specifically, taking a radial distribution network as an example, a simplified DistFlow constraint can be used to calculate the physical consistency residual. For branches... The formula for calculating the active power balance residual is: in, Indicates the inflow node The active power of the branch circuit, Indicates from node The sum of active power flowing to downstream nodes. This represents the reliable node injection quantity or corrected measurement quantity output by the model. The formula for calculating the voltage over-limit residual is: The physical consistency residual is obtained by weighting the active power residual, reactive power residual, voltage residual, and branch capacity residual: in, , , and These are preset weights or weights determined through a validation set. During formal implementation, the physical model can be replaced with a three-phase power flow model, an AC power flow model, a state estimation model, or other distribution network feasibility verification models.

[0044] For rules related to transaction capacity, rule residuals can be defined: in, Representing the subject The declared electricity volume or declared power within a certain time window This indicates contracted capacity, eligible trading capacity, transformer capacity, or other permitted capacity. This represents the allowable deviation coefficient. For discrete rules such as contract effective period, user-metering device binding relationship, and deviation assessment conditions, whether the rule is triggered can be converted into a 0 / 1 variable or a piecewise residual, and included in the audit evidence package along with the model risk score.

[0045] By integrating graph-level risk scores, entity-level risk scores, physical consistency residuals, and business rule residuals, the cross-domain consistency residual vector of the target object is calculated. When it meets the preset multi-dimensional anomaly joint judgment conditions, false transaction data is identified and located. Based on the reverse tracing of multi-dimensional cross-domain meta-paths, an audit evidence package containing abnormal time windows, abnormal spatial paths, physical residuals, and rule triggering items is generated.

[0046] In this embodiment, as a preferred implementation method, the implementation steps are as follows: By using a preset normalization function, the risk score, the physical consistency residual, and the business rule residual representing transaction declaration exceeding limits or contract binding mismatch are mapped to a unified dimension space, and then spliced ​​together to generate a high-dimensional cross-domain consistency closed residual vector.

[0047] Build a multi-level risk alert filtering engine: If the graph-level risk score or entity-level risk score exceeds the first baseline security threshold, but the cross-domain consistency closure residual vector does not show significant joint deviation between dimensions, the target object will be downgraded and marked as an observation-level candidate queue, and the strong audit procedure will be temporarily suspended. If the risk score exceeds the second highest security threshold, and the magnitude of the physical consistency residual or the frequency of triggering business rule residuals in the cross-domain consistency closed residual vector exceeds the set joint review threshold, the corresponding subsequent anti-counterfeiting traceability verification procedure will be automatically triggered.

[0048] Extract the offline topology version library and metering history stubs corresponding to the abnormal time window for forced offline power flow re-verification and anti-counterfeiting traceability verification; determine the data as fake transaction data based on the confirmation result of the forced offline power flow re-verification, and extract relevant evidence fields based on business relationship and cryptographic mechanism.

[0049] The system generates business evidence fields that not only include abnormal time windows, suspicious users, and suspicious distribution branch location information, but also encapsulates the underlying input data digest hash value and network topology version identification information extracted based on an anti-tampering hash algorithm, ultimately generating a structured audit evidence package that can be manually reviewed and accepted by judicial supervision.

[0050] The expression for the audit evidence set is: In the above formula, Evidence of time includes abnormal time windows, load mutation points, and reported mutation points; Evidence of relationships includes abnormal metapaths, suspicious transaction entities, suspicious users, suspicious contracts, and suspicious metering devices; This represents physical evidence, including node injection residuals, branch power flow residuals, voltage overruns, and state estimation results. Evidence representing rules includes capacity overruns, inconsistent bindings, inconsistent contract effective dates, and deviation assessment rule triggers; This indicates traceability information, including model version, rule version, topology version, input data hash, and evidence number.

[0051] Through this formalized set of evidence, the model output can be reviewed, replayed, and archived.

[0052] This system employs a combination of hardware and software processes. Online phase: 1. Access the latest transaction, metering, and topology data; 2. Update the power behavior graph; 3. Use a graph learning model to output a risk score; 4. Generate a candidate queue based on risk scores, physical residuals, and rule residuals; 5. Classify the candidate samples.

[0053] Offline phase: 1. Perform state estimation or power flow calculation on high-risk samples; 2. Review the contracted capacity, declared electricity volume, metering binding, and settlement rules; 3. Check the topology version and the quality of the measurement data; 4. Generate audit evidence package; 5. Hand over to manual review or monitoring processes for processing.

[0054] The advantage of this process is that the online model is responsible for quickly identifying risks, while the offline hard verification is responsible for improving the reliability of alarms.

[0055] (1) Tiered alarm strategy In one implementation, the system sets tiered alarms based on risk scores, physical residuals, rule residuals, and offline verification results.

[0056] Level 1 alarms are observation-level alarms, applicable to samples whose risk scores reach a low threshold but whose physical and rule residuals are not yet significant. These samples are added to the monitoring list and do not directly trigger manual audits.

[0057] Level 2 alarms are review-level alarms, applicable to samples with high risk scores, or whose relational residuals, physical residuals, or rule residuals all reach the review threshold. These samples are then entered into a manual or semi-automatic review queue.

[0058] Level 3 alarms are high-priority audit alarms, applicable to samples with high risk scores and further support for anomaly detection through offline power flow verification, status estimation review, or business rule review. These samples generate a complete audit evidence package and can proceed to settlement review, internal audit, or pre-regulatory review processes.

[0059] The tiered thresholds can be configured based on audit resources, market rules, false alarm tolerance, and risk level.

[0060] (2) Three-tier deployment architecture This invention can be deployed in the form of an offline layer, an online screening layer, and a verification layer.

[0061] The offline layer is responsible for maintaining the historical data warehouse, historical snapshots of the power behavior graph, the topology version library, the rule version library, and model training tasks. The offline layer can periodically reconstruct slowly changing layers and retrain or calibrate the model after changes in contract rules, topology versions, or market rules.

[0062] The online screening layer is responsible for accessing real-time or near real-time transaction data, measurement data, and operational measurement data, updating the rapid change layer in a micro-batch manner, and performing risk scoring. The online screening layer outputs a candidate sample queue, risk ranking, preliminary residuals, and tiered alarms.

[0063] The review layer is responsible for performing state estimation, power flow calculation, rule review, topology version review, and evidence package generation on high-risk candidate samples. The review layer can connect to audit ticket systems, regulatory interfaces, settlement review systems, or manual review platforms.

[0064] This three-tier architecture decouples high-frequency online screening from low-frequency, high-reliability verification, making it suitable for the business process in power market audits that involves first identifying risks, then forming evidence, and finally conducting manual verification.

[0065] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0066] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Since the above embodiments are substantially similar to the method embodiments, their descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0067] The above embodiments provide a detailed description of the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for intelligent identification of fraudulent transaction data that integrates electricity consumption behavior mapping and physical constraints, characterized in that, Includes the following steps: Acquire multi-source power data and operational measurement data, preprocess them to obtain standard data, perform entity alignment and topological association on them to construct a cross-domain dataset; Based on cross-domain datasets, a heterogeneous time-series behavior graph of power is constructed, which includes multiple node types and multiple edge types. According to the difference in data update frequency, the heterogeneous time-series behavior graph of power is divided into slow-changing layer and fast-changing layer. In the heterogeneous time-series behavior graph of the power industry, a multi-dimensional cross-domain meta-path containing semantic constraints of power business is defined. The graph data is input into a pre-trained relation-aware graph learning model. The cross-domain relation features are aggregated and represented along the multi-dimensional cross-domain meta-path through an attention mechanism to generate graph-level risk scores, entity-level risk scores and estimated values ​​of trusted node injection for the target object. Based on the preset distribution network physical model and the estimated value of the injected quantity of trusted nodes, the power flow analysis of the distribution network system is carried out, the physical consistency residual is calculated, the preset power trading capacity and settlement compliance boundary are parameterized and mapped, and the business rule residual is calculated. By integrating graph-level risk scores, entity-level risk scores, physical consistency residuals, and business rule residuals, the cross-domain consistency residual vector of the target object is calculated. When it meets the preset multi-dimensional anomaly joint judgment conditions, false transaction data is identified and located. Based on the reverse tracing of multi-dimensional cross-domain meta-paths, an audit evidence package is generated.

2. The intelligent recognition method according to claim 1, characterized in that, The steps for constructing the time-series behavior map of heterogeneous power systems specifically include: Entity objects in the cross-domain dataset are extracted as the basic node types of the graph. The basic node types include at least the transaction entity nodes and user nodes representing market participants, the metering device nodes representing measurement terminals, the contract nodes representing compliance boundaries, and the feeder connection nodes representing the distribution network topology. The edge types of the graph are extracted based on the business interaction relationships and physical cable connection relationships between entity objects in the power system; The edge types include at least the following: transaction entity-user edge representing agency or settlement attribution attributes; user-metering device edge representing terminal data acquisition and mapping attributes; transaction entity-contract edge representing market performance constraints; user-user edge representing historical load characteristic similarity or abnormal coordination attributes; and metering device-feeder topology edge representing power transmission path of distribution network.

3. The intelligent recognition method according to claim 1, characterized in that, The step of dividing the heterogeneous power time-series behavior map into a slow-varying layer and a fast-varying layer specifically includes: Using a preset transaction settlement cycle or measurement data sampling window as the time base, dynamically update the node feature vectors and edge connection weights within the graph; The steady-state topology network, which includes the transaction entity-contract edge, the user-metering device edge, and the metering device-feeder topology edge, is defined as a slowly varying layer. The dynamic evolution network, which includes frequently updated transaction electricity reporting features, smart meter power measurement curves, and user-user edges, is defined as the fast-changing layer.

4. The intelligent recognition method according to claim 1, characterized in that, The steps of defining multidimensional cross-domain meta-paths containing power business semantic constraints in a heterogeneous time-series behavior graph include combining and concatenating multiple node types and multiple edge types to construct a semantic topological association sequence representing specific cross-domain business logic. The semantic topological association sequence includes at least: The transaction entity-user-metering device association sequence is used to align and characterize the longitudinal consistency between the total amount of macro transaction entity reporting behavior in the information domain and the sum of actual physical equipment energy consumption. The user-metering device-feeder association sequence is used to extract and verify the cross-domain association closure between the micro-user metering anomaly status and the physical bearing constraints of the actual distribution feeder. The transaction entity-user-user association sequence is used to laterally scan and characterize the collaborative camouflage of different micro-user groups belonging to the same agent transaction entity within a specific time window. The contract-user-metering-feeder association sequence is used to characterize the cross-domain rigid constraints that penetrate from the market contractual capacity parameters to the actual carrying capacity of the final distribution network physical transformers and lines.

5. The intelligent recognition method according to claim 1, characterized in that, The relationship-aware graph learning model employs a joint optimization objective function that integrates physical mechanism constraints and business rule red lines during the training phase to optimize the gradient of network parameters, and calculates the joint loss value using the joint optimization objective function. The calculation formula is as follows: In the above formula, Indicates the joint loss value; This represents the loss value for identifying fraudulent transactions, calculated based on historical sample labels. The physical consistency residual penalty loss value represents the cross-domain penetration, which forces the model feature space representation to be pulled into the power flow feasibility solution region that satisfies the Kirchhoff equations during iteration; This represents the residual penalty loss value of the business rules, used to ensure that the output of the hard constraint model does not exceed the red line of the market contract and transaction settlement capacity rules; This represents the regularization loss value used to smooth the network weights. These represent the dimension alignment and weight normalization coefficients of the penalty gradients assigned to each constraint, respectively.

6. The intelligent recognition method according to claim 1, characterized in that, The steps of aggregating and representing cross-domain relationship features along multi-dimensional cross-domain meta-paths using an attention mechanism to generate graph-level risk scores, entity-level risk scores, and estimates of the injection volume of trusted nodes with physical dimensions for the target object specifically include: For any target node in the graph, based on the differences in the types of its neighboring nodes, the differences in the types of connecting edges, and the temporal decay characteristics of the time window, a multi-head attention network is used to calculate the relationship-specific attention weight distribution on different business semantic edges. By utilizing relation-specific attention weight distribution to perform weighted fusion and projection transformation on the multidimensional heterogeneous features of its neighboring nodes, a shared hidden layer feature vector representing the consistency state of the target node in the global network topology is generated. The shared hidden layer feature vectors are synchronously fed into multiple parallel prediction network branches, where the classification network branch outputs an entity-level risk score for the target node and a global graph-level risk score in the current graph snapshot environment. The regression prediction network branch reconstructs the corresponding active and reactive power prediction values ​​based on the shared hidden layer feature vectors, which serve as the estimated values ​​of the reliable node injection quantity for subsequent physical equation verification.

7. The intelligent recognition method according to claim 1, characterized in that, The steps for calculating the physical consistency residual, which characterizes the deviation of the actual operating state of the power system, specifically include: The estimated value of the injection of the reliable node is used as the observed proxy value of the actual injected power of the physical topology node of the distribution network. Combined with the pre-acquired distribution network feeder impedance parameters and branch connection relationship matrix, the power flow calculation equation is used to solve the inflow active power, inflow reactive power and line loss power of the distribution branch. Based on Kirchhoff's current law and voltage drop equation, the residuals of active power node balance deviation, reactive power node balance deviation, and node voltage over-limit residuals when the actual operating node voltage deviates from the safe threshold range are calculated for each physical topology node. By introducing a preset penalty weight coefficient matrix, linear or nonlinear weighted aggregation operations are performed on the residuals of active power node balance deviation, reactive power node balance deviation, node voltage over-limit residuals, and line branch capacity over-limit residuals to generate physical consistency residuals that characterize the feasibility of cross-domain closure of the power grid system in this region.

8. The intelligent recognition method according to claim 1, characterized in that, The steps of calculating the cross-domain consistency closed residual vector of the target object and performing multi-dimensional joint anomaly determination specifically include: By using a preset normalization function, the risk score, the physical consistency residual, and the business rule residual representing transaction declaration exceeding limits or contract binding mismatch are mapped to a unified dimension space, and spliced ​​together to generate a high-dimensional cross-domain consistency closed residual vector. Build a multi-level risk alert filtering engine: If the graph-level risk score or entity-level risk score exceeds the first baseline security threshold, but the cross-domain consistency closure residual vector does not show significant joint deviation between dimensions, the target object will be downgraded and marked as an observation-level candidate queue, and the strong audit procedure will be temporarily suspended. If the risk score exceeds the second highest security threshold, and the magnitude of the physical consistency residual or the frequency of business rule residual triggering in the cross-domain consistency closed residual vector exceeds the set joint review threshold, the corresponding subsequent anti-counterfeiting traceability verification will be automatically triggered.

9. The intelligent recognition method according to claim 8, characterized in that, The steps of identifying and locating fraudulent transaction data, and generating an audit evidence package based on reverse tracing of multi-dimensional cross-domain meta-paths, specifically include: Extract the offline topology version library and metering history stubs corresponding to the abnormal time window for forced offline power flow re-verification and anti-counterfeiting traceability verification; Based on the confirmation result of the forced offline flow re-verification, the transaction data was determined to be fraudulent, and relevant evidence fields were extracted based on business relationships and cryptographic mechanisms. The system generates business evidence fields that not only include abnormal time windows, suspicious users, and suspicious distribution branch location information, but also encapsulates the underlying input data digest hash value and network topology version identification information extracted based on an anti-tampering hash algorithm, ultimately generating a structured audit evidence package that can be manually reviewed and accepted by judicial supervision.

Images